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SUMMARY 


This  report  addresses  the  tasks  required  to  determine  whether  or 
not  a  Crash-Survivable  Flight  Data  Recording  (CSFDR)  System  which  meets 
the  critical  performance  requirements  and  cost  constraints  dictated  by 
the  attack/fighter/trainer  (A/F/T)  application,  can  be  defined  with 
current  avionics  technology  for  a  volume  production  program. 

The  first  task  addressed  is  that  of  determining  the  technical 
requirements.  This  task  is  subdivided  into  a  flight  parameter  evalua¬ 
tion,  an  installations  investigation,  and  a  crash-survivability  inves¬ 
tigation.  Following  this,  the  tasks  required  to  formulate  the  well- 
defined  technical  approach  are  addressed.  These  tasks  include  studies 
relative  to  standardization,  expanded  recording,  data  security,  required 
readout  equipment,  and  future  aircraft  applications. 

Special  emphasis  is  given  to  potential  memory  technologies,  data 
processing/compression  techniques,  and  required  software/firmware  for 
the  CSFDR  system. 

Following  these  technical  areas  of  study,  the  economic  areas  for 
life  cycle  costs  (LCC)  and  cost/benefit  are  analyzed. 

The  stidy  shows  that  there  are  five  primary  driving  functions  which 
must  be  optimized  in  order  to  assure  a  CSFDR  system  capability  for  A/F/T 
aircraft.  These  are: 

•  Minimize  the  total  volume  (size)  ot  the  CSFDR  system 
because  space  (real  estate)  is  critical  on  A/F/T  aircraft 

•  Minimize  the  total  weight  (including  all  cables,  brackets 
and  CSFDR  components)  impact  to  the  aircraft  because 
weight  is  also  critical  for  A/F/T  aircraft. 

•  Minimize  the  LCC  of  the  CSFDR  system. 

•  Crash  protect  and  install  the  protected  memory  to  survive 
A/F/T  Class-A  mishaps. 

Design  the  CSFDR  system  to  operate  throughout  the  high-g 
maneuvers  which  are  typical  of  A/F/T  profiles. 


The  study  also  concludes  that  these  five  primary  driving  functions 
are  satisfied  if  the  following  technical  approach  is  taken: 

•  Separate  the  survivable  memory  pack' from  the  remainder  of 
the  CSFDR  system  electronics. 

•  Use  a  solid-state  memory  in  conjunction  with  state-of-the 
art  techniques  for  data  conversion/data  processing/data 
compression. 


Three  CSFDR  system  configurations  are  analyzed  in  this  report: 


Configuration  I 


Configuration  II  - 


Configuration  III 


records  the  maximum  number  of  flight 
parameters  for  the  longest  practical  time 
needed  to  determine  the  cause  of  an  A/F/T 
accident/mishap . 

records  only  the  highest  priority  flight 
parameters  for  the  minimum  time  needed  to 
determine  the  cause  of  an  A/F/T  accident/mishap. 

similar  to  Configuration  I,  but  includes 
non-crash-survivable  memories  to  achieve 
expanded  recording  functions  for  aircraft 
structural  integrity,  turbine  engine  data, 
and  flight  control  monitoring. 


Conclusions  show  that  the  current  state-of-the  art  in  electronic 
technology  permits  Configuration  II,  with  a  minimum  level  of  input 
parameters  (typically  35)  and  an  average  real-time  storage  of  19  minutes, 
to  be  designed  and  produced  at  a  size  and  weight  applicable  to  A/F/T 
aircraft.  The  size  and  weight  are  significantly  less  than  contemporary 
electromechanical  recorders. 


Also,  Configuration  I,  with  a  higher  level  of  input  parameters 
(typically  56)  and  an  average  real-time  storage  of  29  minutes,  can  be 
designed  and  produced  at  a  size  and  weight  applicable  to  A/F/T  aircraft. 
The  size  and  weight  of  this  configuration  are  also  significantly  less 
than  contemporary  electromechanical  recorders.  Moreover,  the  addition 
of  solid-state  Mass  Storage  Units  permits  this  configuration  to  be  used 
for  expanded  airborne  recording  functions.  The  resulting  recorder 
system,  Configuration  III,  is  a  single  standardized  family  of  modules 
which  can  be  used  for  any  set  of  airborne  recording  functions. 

The  memory  technologies  most  suitable  for  incorporation  into  the 
Crash-Survivable  Memory  Unit  (CSMU)  are  the  EE-PROM  and  MMOS  types. 


A  data  compression  technique  which  uses  floating  apertures  and  a 
zero-order  polynomial  predictor,  which  is  adaptive  to  flight  conditions, 
can  be  used  to  reduce  the  crash-survivable  memory  required.  This,  in 
turn,  reduces  the  overall  cost  of  the  CSFDR  system. 

The  reprogrammability  feature  of  the  CSFDR  system  permits  a  common 
design  to  be  used  for  various  aircraft.  The  A-10,  F-15,  and  F-16  were 
studied  for  specific  applications.  Enough  commonality  exists  such  that 
a  single  CSFDR  system  concept  can  be  implemented  for  these  aircraft.  In 
addition,  the  standard  CSFDR  system  can  be  reprogrammed  for  many  other 
applications . 

All  configurations  studied  had  very  positive  cost/benefit  ratios 
for  the  three-aircraft  program  (A-10,  F-15,  and  F-16).  Characteristics 
of  these  configurations  are  shown  in  table  1. 


Table  1.  Characteristics  of  Configurations  I,  II,  and  III 


Completely  solid- 

state  sytem 

-  Data  Processor  Unit  (DPU)  and  Crash- 
Survivable  Memory  Unit  (CSMU) 

Expanded  recording  functions 

-  Via  Mass  Storage  Units  (MSU) 

CSMU  and  MSU  separable  from  DPU  -  Installed  as  single  unit  or  in  com¬ 

binations  of  DPU  plus  remotely 
located  memories 

Low-Power  Crash-Protected  Memory  -  Very  low  power,  solid-state, 

(CPM)  non-volatile 

Microprocessor  controlled 

-  Data  conversion,  processing,  and 
compression,  including  BIT 

CSMU  survivability 

Per  recommended  A/F/T  crash-surviv¬ 
ability  specification 

Characteristic 

DPU 

CSMU 

MSU 

TOTAL 

Size:  I 

212  in3 

MSMSM 

. 

254  in3 

II 

197  in3 

- 

232  in3 

III 

212  in3 

c 

•H 

00 

o 

r-s 

362  in3 

Weight:  I 

8.4  lbs 

2.8  lbs 

- 

11.2  lbs 

II 

7.6  lbs 

2.4  lbs 

- 

10.0  lbs 

III 

8.4  lbs 

2.8  lbs 

6.0  lbs 

17.2  lbs 

Table  1.  Characteristics  of  Configurations  I,  II,  and  III  (Continued) 


Characteristic 

DPU 

CSMU 

MSU 

TOTAL 

Power :  I 

40  watts 

1  watt 

- 

41  watts 

II 

35  watts 

1  watt 

- 

36  watts 

III 

40  watts 

1  watt 

10  watts 

51  watts 

Average  I 

- 

29  min 

- 

- 

Flight  II 

- 

19  min 

- 

- 

Time  III 

- 

29  min 

15  hrs 

- 

Retained: 

Memory  I 

- 

131,072  bits 

- 

131,072  bits 

Required:  II 

- 

65 ,536  bits 

- 

65,536  bits 

III 

131,072  bits 

256Kxl6  bits 

264Kxl6  bits 

MTBF :  I 

5,258  hrs 

63,613  hrs 

- 

4,856  hrs 

II 

5,580  hrs 

89,047  1-s 

- 

5,251  hrs 

III 

5,258  hrs 

63,613  hi i 

3,400  hrs 

2,000  hrs 

Maint.  I 

2.899  hrs 

0.204  hrs 

3.103  hrs 

Mn/hrs  II 

2.733  hrs 

0.146  hrs 

- 

2.879  hrs 

per  III 

2.899  hrs 

0.204  hrs 

3.823  hrs 

6.926  hrs 

1C00 

Operating 

Hours : 

Program  I 

3,140  wds 

- 

- 

3,140  wds 

Memory:  II 

3,000  wds 

- 

- 

3,000  wds 

III 

3,400  wds 

3,400  wds 

Random  I 

2,000  wds 

- 

2,000  wds 

Access  II 

2,000  wds 

- 

- 

2,000  wds 

Memory:  III 

2,000  wds 

“ 

2,000  wds 

The  expanded  recording  functions  have  only  a  minor  effect  on  the 
conversion  and  processing  functions  of  Configuration  I.  These  expanded 
recording  functions  are  easily  achieved  by  adding  Mass  Storage  Units  to 
the  basic  system. 

Encryption  techniques  which  result  in  only  one-half  of  a  board  of 
processor  "real  estate"  can  be  used  to  provide  all  the  security  pro¬ 
tection  features  required  for  operation  at  or  near  enemy  territory. 

A  readout  station  having  a  four-level  readout  capability  can  easily 
be  provided  to  Norton  AFB  for  mishap  investigations.  This  station  would 
utilize  a  solid-state  data  processor  retrieval  unit  made  directly  com¬ 
patible  with  the  existing  Norton  AFB  EDP  facility.  Alternate  readout 
facilities  are  also  possible  at  minimum  risk  to  the  USAF. 

A  portable  Data  Retrieval  Unit  (DRU)  can  also  be  used  to  extract 
data  from  the  CSFDR  system.  This  unit  utilizes  Data  Trarsfer  Modules 
(DTMs)  which  are  already  in  the  USAF  inventory.  Each  DTM  consists  of 
8  K  words  x  16  bits  of  solid-state  memory.  These  solid-state  "cassettes" 
can  then  be  sent  to  Norton  AFB  for  timely  use  in  the  mishap  investiga¬ 
tion.  Only  one  DRU  is  required  at  each  base. 

The  overall  CSFDR  system  concept  is  shown  in  figure  1. 

The  recommendation  is  to  continue  work  in  the  CSFDR  system  area  as 
soon  as  funding  permits.  Although  all  three  configurations  studied  had 
positive  cost/benef it  ratios,  Configurations  II  and  III  are  the  only 
configurations  recommended  for  future  development  and  production.  If 
budget  and  time  for  development  are  not  extremely  critical,  Config¬ 
uration  III  is  recommended.  If  either  budget  or  time  is  felt  to  be 
critical  by  the  affected  USA!'  agencies,  then  Configuration  II  is 
recommended. 

Also,  Configuration  II  is  recommended  for  retrofit  applications 
where  the  aircraft  structural  integrity,  turbine  engine  data,  and  flight 
control  recorders  have  already  been  procured  and  installed.  For  new 
aircraft  applications,  Configuration  III  is  the  recommended  recorder 
system,  and  additional  recorders  need  not  be  procured  for  these  aircraft. 


vi 
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Figure  1.  Crash-Survi vable  Flight  Data  Recording 
(CSFDR)  System  Concept 
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1  INTRODUCTION 


There  are  two  broad  objectives  of  the  CSFDR  system  study  as  described 
herein : 


a.  Perform  technical  feasibility  studies  which  relate  specific 
equipment  configurations  and  capabilities  to  various  aircraft  applications, 
and  to  evaluate  alternative  technical  approaches  for  meeting  the  application 
goals . 

b.  Perform  economic  studies  which  compare  life  cycle  costs 
(LCC)  to  potential  benefits  resulting  from  incorporating  a  standard 
CSFDR  system  into  various  aircraft  programs. 

The  final  output  of  the  study  allows  factually  backed  decisions  to 
be  made  to  continue  the  program  into  the  prototype  and  production  stages. 

The  top  priority  of  the  study  is  to  cover  the  requirements  for 
attack/f ighter/trainer  (A/F/T)  aircraft  and  the  study  is  scaled  accordingly. 
Portions  of  the  study  which  are  covered,  but  ranked  lower  in  priority, 
are  tri-service  standardization,  large-scale  standardization,  and  expanded 
recording  applications. 

General  and  specific  studies  for  the  A/F/T  class  of  aircraft  are 
conducted.  Specific  aircraft  include  the  A-10,  F-15,  and  F-16.  A 
general  A/F/T  type  of  aircraft  is  hypothesized  and  application  of  the 
CSFDR  system  to  both  existing  and  future  aircraft  is  addressed.  The 
state  of  the  art  of  crash-survivable  recording  systems  is  reviewed  in 
terms  of  memory  technologies  to  determine  the  applicability  of  these 
systems  to  the  A/F/T  problem.  More  advanced  memory  systems  using  solid- 
state  technology  are  analyzed  in  detail. 

Specific  technical  tasks  are: 

•  Flight  parameter  evaluation 

•  Aircraft  installation  investigation 

•  Crash-survivability  investigation 

•  Tri-service  standardization  investigation 

•  Application  to  future  A/F/T  aircraft 

•  Large-scale  standardization  investigation 

•  Expanded  recording  applications 

•  Security  of  airborne  recorded  data 

•  Data  readout  facilities 

•  Determination  of  technical  approach 

•  Reliability  and  maintainability  analysis 
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Specific  economic  tasks  are: 

•  LCC  calculations  for  Configurations  I,  II,  and  III. 

•  Cost/benefit  analysis  for  Configurations  I,  II,  and  III. 

It  is  recognized  from  the  onset  that  solving  the  problem  of  providing 
a  CSFDR  system  capability  for  A/F/T  aircraft  is  one  of  the  more  difficult 
problems  facing  the  avionics  industry.  Therefore,  a  heirarchy  of  design 
requirements  was  formulated  for  the  study  and  each  specific  area  of  the 
study  was  oriented  to  satisfying  the  top  priority  requirements.  These 
top  priority  requirements  are: 

•  Minimum  size 

•  Minimum  weight  impact  to  aircraft 

•  Minimum  LCC 

•  A  high  degree  of  survivability 

•  Continual  uninterrupted  recording  through  high-g  maneuvers. 

Although  there  are  many  additional  requirements  which  the  CSFDR 
system  must  meet ,  it  is  believed  thjt  optimization  of  the  top  priority 
requirements  will  provide  the  long  sought  after  CSFDR  sys  em  capability 
for  A/F/T  aircraft. 


2 


2.  AIRCRAFT  CRASH-SURVIVABLE  FLIGHT  DATA  RECORDING  SYSTEMS 


2.1  Summary  of  the  problem  and  its  facets 

Accident/mishap  statistics  for  attack/f ighter/trainer  (A/F/T) 
aircraft  show  an  alarming  trend  in  terms  of  cost  per  incident.  The 
percentage  of  incidents,  in  which  the  cause  is  unknown,  remains  unac¬ 
ceptably  high.  Moreover,  peacetime  operational  incidents  have  con¬ 
tributed  directly  to  the  continuing  problem  of  force  shrinkage.  In 
fact,  during  the  past  several  years,  one  service  has  bought  fewer  A/F/T 
aircraft  than  are  being  lost  in  peacetime  operational  accidents.  Current 
rates  of  inflation  and  limited  combat  resources  of  an  irreplaceable 
nature  strongly  dictate  that  a  CSFDR  capability  for  A/F/T  aircraft  be 
developed  as  soon  as  technology  permits. 

When  aircraft  accidents  occur,  it  is  extremely  important  to  deter¬ 
mine  the  cause  in  order  to  reduce  the  probability  of  future  accidents. 
Military  and  commercial  aviation  have  definite  procedures  to  cope  with 
mishaps  as  they  occur.  AFM  127-1,  entitled  Aircraft  Accident  Prevention 
and  Investigation,  provides  the  framework  for  the  USAF  procedures.1 
Actual  authority  and  establishment  of  requirements  for  investigating  Air 
Force  aircraft  accidents  and  incidents  is  contained  in  AFR  1 27 - A . 2 

The  following  words  are  taken  directly  from  AFM  127-1,  section  8-1, 
page  8-1: 


Aircraft  accidents  can  be  prevented  when 
their  causes  are  known.  Causes  can  be 
determined  only  by  investigation. . . . 

Investigation  provides  information  and 
statistical  data  which  serves  as  the  basis 
for  corrective  action  and  for  strengthen¬ 
ing  the  accident  prevention  effort. 

It  is  important  to  note  the  reference  to  statistical  data  and  its 
importance  as  a  basis  for  corrective  action.  A  CSFDR  system  would 
greatly  supplement  the  amount  and  accuracy  of  such  statistical  data. 


lUSAF  Manual,  127-1,  "Aircraft  Accident  Prevention  and  Investi¬ 
gation".  Effective  date  14  July  1976. 

2USAF  Regulation,  127-4,  "Investigating  and  Reporting  U.S.  Air 
Force  Mishaps".  Effective  date  18  January  1980. 
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The  following  paragraph  is  also  taken  directly  from  AFM  127-1, 
section  8-2,  page  8-1: 


The  purpose  of  an  aircraft  accident  inves¬ 
tigation  is  to  determine  all  factors, 
human  and  material,  which  directly  or 
indirectly  contributed  to  the  accident. 

This  information  can  be  used  by  pilots, 
supervisors,  commanders  and  staffs  to 
eliminate  the  cause  factors  and  thus 
prevent  recurrence  of  similar  accidents. 

Each  accident  investigation  adds  to  the 
overall  USAF  accident  experience,  provid¬ 
ing  a  basis  for  corrective  action.  The 
proper  use  of  accident  experience  results 
in  the' elimination  of  accident  potentials. 

Moreover,  the  requirements  for  additional 
training  are  disclosed,  realistic  main¬ 
tenance  requirements  are  determined, 
material  is  improved,  future  design  cri¬ 
teria  are  established  and  many  other 
long-range  results  are  achieved  through 
the  use  of  accident  history.  The  accuracy 
and  thoroughness  of  investigation  deter¬ 
mines  the  adequacy  of  ultimate  action  to 
remove  or  eliminate  factors  that  cause  or 
contribute  to  accidents. 

It  is  important  to  note  the  reference  to  accuracy  and  thoroughness 
of  investigation,  which,  in  turn,  determines  the  adequacy  of  ultimate 
action.  Again,  the  CSFDR  system  would  be  invaluable  in  this  effort. 

The  need  for  recorded  data  is  indicated  from  the  two  AFM  127-1 
excerpts.  However,  this  need  is  expressed  more  formally  in  the  official 
Statement  of  Need  (SON)  for  Flight  Data  Recorder  (FDR)  for  Attack/ 
Fighter/Trainer  Aircraft.3  Paragraph  3a  of  the  SON  states  the  opera¬ 
tional  deficiency  as  follows: 


3USAF  "SON  for  FDR  for  Attack/Fighter/Trainer  Aircraft",  from  AFISC 
dated  27  August  1979,  signed  by  General  Garry  A.  Willard,  Jr. 
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Mishap  investigations  are  inherently 
tedious,  time  consuming,  and  costly.  Many 
findings  of  mishap  investigation  boards 
are  based  on  probable  sequence  of  events 
due  to  lack  of  concrete  evidence.  Most  of 
the  time,  physical  evidence  of  systems 
operation  or  malfunction  is  destroyed  in 
the  mishap.  The  lack  of  an  FDR  to  record 
and  make  available  systems  operation  or 
malfunction  information  greatly  hampers 
these  investigations. 

Thus,  the  need  for  recorded  data  is  well  established.  Since  exist¬ 
ing  A/F/T  aircraft  are  not  equipped  with  CSFDRs ,  current  mishap  informa¬ 
tion  is  often  vague  and  qualitative  in  nature.  This  information  now 
comes  from  reports  from  the  other  aircraft  in  the  flight,  eyewitness 
accounts,  study  of  the  wreckage,  study  of  the  accident  site  scars,  and 
related  data  such  as  weather  conditions,  flight  records,  and  maintenance 
records.  Thus,  in  many  cases,  the  probable  cause  remains  undetermined, 
inaccurate,  or  too  vague  to  satisfy  the  expressed  need  for  corrective 
action.  Additionally,  some  mishaps  have  been  charged  to  "piloc  error" 
in  spite  of  the  fact  that  certain  types  of  pilot  error  are  design-induced 
and  the  actual  conditions  which  led  to  pilot  error  remain  unknown. 

It  should  also  be  noted  that  aircraft  complexity  and  performance 
have  made  the  accident  investigation  process  more  difficult.  This  is 
especially  true  for  A/F/T  aircraft.  Moreover,  the  expense  of  A/F/T 
aircraft  has  made  the  consequences  more  severe.  Thus,  there  has  recently 
been  an  increased  demand  from  accident  investigators  for  accurate  quan¬ 
titative  data. 

Benefits  to  be  derived  from  the  CSFDR  system  are  summarized  as 
follows : 


•  Improved  accident/mishap  information  data  (which  permits 
a  more  accurate  conclusion  and  a  reduced  number  of  future 
accidents) . 

•  Reduced  aircraft  and  aircrew  losses. 

•  Reduced  accident/mishap  investigaton  costs. 

•  Reduced  reaction  time  in  identifying  and  correcting 
operational  deficiencies. 

•  Reduced  reaction  time  in  identifying  and  correcting 
aircraft  hardware  deficiencies. 
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Improved  strike  capability  due  to  reduced  fleet  down 
times  following  an  accident/mishap. 


2.2 


•  Improved 
spate  of 

•  Improved 

•  Improved 

•  Improved 

•  Improved 
Background 


pilot  morale  by  eliminating  the  possibility  of  a 
accidents  due  to  similar  causes. 

history  of  parameter  limit  exceedance  for  A/F/T. 

pilot  performance/training. 

data  concerning  subsystem  performance. 

maintenance  data. 


Current  CSFDRs  are  designed  for  use  in  large  transport-type  air¬ 
craft  and  are  electromechanical  in  nature.  Two  types  are  in  use  today: 
(1)  oscillographic  recorders  which  produce  markings  on  a  metal  foil, 
and  (2)  magnetic  tape  recoiding  systems  which  require  3  digital  data 
acquisition  unit  and  a  separate  crash-protected  digital  magnetic  tape 
recorder.  Both  types  are  too  large  (usually  over  700  cubic  inches)  and 
too  heavy  (usually  over  20  pounds)  for  effective  incorporation  into 
A/F/T  aircraft.  Moreover,  the  technology  associated  with  these  electro 
mechanical  recorders  is  very  mature  and,  therefore,  it  is  very  unlikely 
that  significant  weight/volume  improvements  will  be  achieved  in  the 
foreseeable  future. 


Nevertheless,  the  requirement  exists  for  crash-survivable  recording 
systems  on  military  aircraft  as  evidenced  by  directives  and  advisories 
issued  by  the  U.S.  Air  Force  and  Navy.  Some  systems  have  been  installed 
on  large  Air  Force  aircraft  such  as  the  C-5A,  C-141,  and  C-135  transports. 

A  system  has  been  specified  and  developed  for  the  Air  Force  B-l  prototypes. 
Some  of  these  systems  increase  the  probability  of  data  retrieval  by 
ejecting  a  data  pack  from  the  aircraft  when  high  acceleration  or  breakup 
is  detected.  A  radio  beacon  is  included  to  aid  in  locating  the  package. 

A  policy  statement  exists  within  the  Air  Force  which  advises  the  use  of 
crash  recorders.4  For  large  aircraft  such  as  those  mentioned  above,  the 
policy  statement  can  be  met  with  existing  hardware. 


4U.S.  Air  Force,  "Air  Force  Policy  on  Flight  Data  Recorders  and 
Crash  Position  Indicators",  Chief  of  Staff  Policy  Letter  dated  16  June 
1973,  signed  by  General  John  D.  Ryan. 
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However,  the  requirements  of  the  policy  statement  cannot  be  ful¬ 
filled  on  high-performance  aircraft,  such  as  trainers  and  fighters, 
because  of  the  high  cost,  size,  and  weight  of  available  equipment.  As  a 
result,  no  high-performance  aircraft,  in  inventory  or  coming  cn  line, 
have  such  a  system  installed  for  routine  military  operations.  This 
represents  a  paradox  to  many  people  because  the  accident  rate  of  high 
performance  aircraft  is  significantly  higher  than  that  of  transport  type 
aircraft . 

Within  the  U.S.  Navy,  a  directive  is  currently  in  force  that  requires 
an  ejectable  type  of  system  on  all  new  aircraft  being  delivered.5 

The  Navy  system  contains  voice  and  data  and  includes  a  radio  beacon 
located  within  the  ejectable  portion  of  the  system.  Large  Navy  aircraft 
currently  being  delivered  have  such  systems.  However,  for  A/F/T  aircraft, 
such  as  the  F-14  and  F— 18,  the  requirement  has  been  waived  because  of 
the  size,  weight,  and  cost  associated  with  present  technology. 

2.3  Solving  the  problem 

Emerging  solid-state  electronics  and  insulation  technologies  now 
appear  to  offer  an  approach  which  is  technically  and  economically  feas¬ 
ible  for  the  A/F/T  problem.  Solid-state  memories  such  as  MNOS  and  CMOS 
permit  increased  reliability,  elimination  of  periodic  maintenance, 
reduced  size,  and  reduced  weight.  Microprocessors  permit  a  more  effic¬ 
ient  recording  process  by  analyzing  the  data  and  only  recording  the 
non-redundant  portions,  thereby  minimizing  the  amount  of  crash-protected 
memory  required.  Microprocessors  also  permit  easy  growth  to  new,  expanded 
recording  functions  because  of  their  high  speed  and  reprogrammability 
features.  New  insulation  technologies,  such  as  those  currently  being 
used  in  the  NASA  space  program,  appear  to  offer  equivalent  thermal 
capabilities  at  reduced  weight  and  volumes. 

Thus,  the  application  of  new  CSFDR  systems  appears  to  be  feasible 
for  small,  high  performance  aircraft  in  the  current  and  planned  USAF 
inventory. 


5U.S.  Navy,  "Crash  Position  Indicator/Flight  Data  Recorder  Systems 
for  Naval  Aircraft".  Chief  of  Naval  Operations  Message  CNO  1416102, 
April  1972. 
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3.  TASK/TECHNICAL  REQUIREMENTS 


3.1  Determination  of  requirements, 

3.1.1  Flight  parameter  evaluation 

3. 1.1.1  RFP  requirements  -  As  an  introduction  to  the  flight  param¬ 
eter  evaluation  section,  o  restatement  of  the  RFP  requirements  is  given. 
The  evaluation  should  be  done  in  terms  of: 

a.  Parameter  characteristics 

•  Dynamic  range 

•  Data  source 

•  Relationship  to  time  history 

•  Interrelationship  of  parameters  between  subsystems 

b.  Parameter  relative  importance 

•  Benefit  in  accident/mishap  analysis 

•  Difficulty  or  cost  to  acquire 

•  Difficulty  or  ease  of  data  processing  for  recording  and  use 

•  Installation  accessibility 

•  Volume  and  weight  addition 

•  Reliability  of  data  and  effects  on  monitored  systems 

•  Safety  effects  on  monitored  systems 

c.  A  general  prioritized  parameter  list  with  rationale  and  sup¬ 
porting  data  shall  be  compiled. 

d.  Specific  parameter  lists  shall  be  compiled  for  typical  example 
aircraft:  A-10,  F-15,  and  F-16.  These  lists  shall  meet  the  requirements 
of  Configuration  I  (maximum  number  of  parameters  for  the  longest  practical 
time  for  A/F/T  aircraft),  Configuration  II  (smallest  number  of  parameters 
to  provide  adequate  accident  investigation  in  optimized  size  and  cost) 
and  Configuration  III  (Configuration  I  with  added  parameters  necessary 

to  round  out  the  list  for  the  structural  integrity  program,  engine 
health  and  flight  control  monitoring). 

e.  These  specific  lists  shall  diifer  from  the  general  list  as 
necessary  for  the  unique  requirements  of  the  three  example  aircraft. 

The  priority  sequence  shall  also  be  tailored  to  the  unique  requirements. 

3 . 1 . 1 . 2  General  discussion  of  parameter  needs,  uses,  and  types 

a.  Flight  parameter  t>  >es  and  groupings  can  be  organized  into  the 
following  generalized  catego  es: 
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•  Flight  dynamics 

•  Flight  control  systems  (including  pilot  input) 

•  En.gine/power  plant  (including  hydraulic) 

•  Avionics  systems/reference  systems 

•  Weapons/stores  inventory  and  delivery  systems 

•  Miscellaneous  subsystems  and  devices  (such  as  landing 

gear,  antiskid,  nosewheel  steering,  etc.) 

•  Environmental  systems 

•  Electrical  power  systems 

b.  Types  of  contributions  to  mishaps  and  accidents.  The  param¬ 
eters  to  be  recorded  are  intended  to  provide  sufficient  information  to 
deduce  the  cause  of  the  accident/mishap  which  may  be  precipitated  by 
individual  or  combinations  of  the  following  conditions  or  situations: 

•  Structural,  equipment  or  component  failure.  If  all 

accidents  could  be  attributed  to  failures,  then  a  com¬ 
prehensive  status  and  BIT  monitoring  system  would  provide 
all  of  the  parameter  data  required.  Dynamic  data,  flight 
control  input  and  response  data  would  be  unnecessary. 

Such  is  not  the  case.  Most  accidents  occur  when  the 
pilot  or  aircraft  is  at  or  near  the  limits  of  the  respec¬ 
tive  performance  capability. 

Operation  outside  of  and  departure  from  the  safe  flight 
envelope.  With  all  systems  working  perfectly,  the  air¬ 
craft's  capabilities  or  its  subsystems'  capabilities  may 
be  exceeded,  resulting  in  stalls,  spins,  collisions, 
failure  to  pull  up,  induced  structural  failure,  etc. 

This,  in  the  broad  sense,  could  be  attributed  to  pilot 
error,  but,  for  analysis  purposes,  it  is  necessary  to 
record  parameters  defining  the  aircraft  dynamic  responses 
and  flight  path. 

•  Exceeding  operational  limits.  Again,  this  can  be  called 
pilot  error,  but  is  separated  out  for  the  purpose  of  this 
study  because  it  requires  that  certain  distinct  parameters 
be  recorded.  Consider  the  relatively  simple  case  of 
deteriorating  weather  and  diminishing  fuel  supply.  Time, 
total  fuel,  powel  settings,  and  aircraft  configurations, 
for  example,  are  all  important  in  deducing  the  cause  of 
the  crash  if  the  pilot  does  not  survive. 

•  Human  error/physical  impairment.  Obviously,  errors  in 
instrument  reading  and  pilot  judgment  cannot  be  recorded. 
Tiie  effects,  to  a  great  extent,  can  be  recorded.  If 
sufficient  parameters  arc  recorded  to  show  the  i  istrument 
and  other  inputs  to  tie  pilot,  and  points  are  moi itored 
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that  record  the  pilots  reaction,  then  the  pilot's  judge¬ 
ment  and  response  can  be  deduced.  These  same  parameters 
allow  for  a  reasonable  deduction  of  the  possibility  of 
physical  impairment. 

•  Outside  influences,  catastrophic  or  deteriorating  situa¬ 
tions.  These  situations  can  be  recognized  by  examples 
such  as  midaii  collision,  terrain  impact,  and  bad  weather 
with  icing  or  heavy  turbulence.  Some  of  these  can  be 
related  to  pilot  and  equipment  limitations  with  final 
overwhelming  by  the  outside  influences.  Recording  of 
navigation  parameters,  secondary  aircraft  functions  such 
as  anti-ice  status  and  g  forces  would  be  useful  for  the 
above  examples. 

•  Temporary  induced  failure.  As  an  example,  consider  the 
events  or  conditions  leading  to  a  flameout.  This  type  of 
situation  may  use  the  same  parameters  for  analysis  that 
are  recorded  for  the  analysis  of  engine  failure.  In 
addition,  however,  the  pilot's  actions  and  aircraft 
dynamic  response  just  prior  to  flameout  are  needed  to 
help  determine  the  cause,  not  just  the  fact  of  the  flame¬ 
out.  It  is  the  cause  of  the  anomaly  that  is  sought,  not 
the  result  of  the  anomaly. 

3 . 1 . 1 . 3  Development  of  the  flight  parameter  general  list  -  The 
flight  parameter  general  list  is  developed  in  the  following  manner. 

First  a  comprehensive  list  is  generated  for  each  of  the  categories 
listed  in  3.1.1.2a.  This  list  is  intended  to  contain  every  obtainable 
parameter  in  each  category  that  could  be  of  conceivable  use  in  accident/ 
mishap  investigation.  Since  the  list  is  not  specialized,  *>f  Mie 

parameters  will  be  general,  but  hopefully  sufficient  to  prevent  over¬ 
looking  of  similar  specific  parameters  for  the  special  lists  presented 
lat'r.  The  general  list  is  followed  by  another  list  which  has  been  put 
into  a  prioritized  order  based  on  past  user  lists  and  stated  priorities. 
It  is  listed  in  the  exact  order  derived.  Additional  details  will  appear 
in  that  section.  Upon  reviewing  the  first  prioritized  list,  it  becomes 
apparent  that  certain  relationships  and  balances  will  require  some 
reordering  of  the  list.  Next,  specific  lists  are  presented  for  the 
A-10,  F- 15,  and  F— 16.  The  lists  are  comprehensive  listings  showing  the 
Alternate  Configuration  I  list  of  parameters.  Reasons  for  specific 
selections  are  explained.  The  list  is  then  edited  down  to  Configura¬ 
tion  II,  the  minimum  number  of  parameters  deemed  necessary  for  accident/ 
mishap  analysis. 

Section  3. 2. A  will  cover  the  additional  parameters  needed  to  replace 
the  functions  of  the  existing  ASIPs  recorders,  the  engine  health  recorder 
and  any  remaining  flight  control  parameters. 
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a.  General  parameters  list  (table  2).  The  general  parameters  list 
is  categorized  according  to  the  parameter  characteristics  listed  in 
3.1.1.2a.  It  is  intended  to  contain  all  parameters  useful  to  accident 
investigation,  structural  integrity,  engine  health  and  flight  control 
functions . 

b.  Interrelationship  of  parameters.  The  interrelationship  of 
many  parameters  will  often  permit  some  to  be  omitted  from  direct  record¬ 
ing  and,  instead,  to  be  derived  from  the  others.  Reciprocal  derivations 
do  not  always  produce  satisfactory  data  as  will  be  indicated  later 

This  paragraph  will  only  touch  the  surface  of  the  subject  with  some 
simple  examples. 

Inertial  Measurement  Units  are  being  considered  on  most  aircraft, 
and  have  certain  outputs  available  on  the  multiplex  bus  that  cover  the 
full  dynamic  range  of  the  aircraft.  Unfortunately  for  accident/mishap 
analysis,  the  velocity  and  acceleration  data  is  in  the  fixed-earth  axis 
coordinate  system  (for  navigation).  The  IMUs  also  output  roll,  pitch 
and  heading  data  which  supply  the  needed  Euler  angles  for  conversion  to 
aircraft  axis  information  which  can  be  computed  on  the  ground.  Also 
derivable  are  angle-of-attack,  sideslip  and  rotational  rates.  The 
derivable  parameters  are  mathematically  correct  only  in  a  no-wind  condi¬ 
tion  since  the  inertial  data  represents  motion  in  respect  to  (for  pur¬ 
poses  of  this  discussion)  the  earth  which  may  include  strong  vinos.  The 
data  needed  for  the  accident/  mishap  investigation  is  mostly  aircraft 
motion  in  the  airm^ss.  Wind  data,  if  known,  could  be  used  in  the  deriva¬ 
tions,  although  it  would  not,  however,  be  practical  unless  recorded  with 
the  other  data.  Such  is  possible,  since  the  IMUs  output  true  heading, 
aircraft  heading  and  ground  track  in  some  form  TACAN  inputs  would  be 
helpful.  Generally,  angle-of-attack  and  sideslip  angles  obtained  by 
derivation  contain  large  errors  because  of  local  disturbances,  the 
extreme  smoothing  of  the  navigation  data,  and  the  complications  of  the 
derivations  with  dynamically  changing  attitudes  and  the  number  of  vari¬ 
ables  in  the  computation.  Where  the  difficulty  or  expense  of  adding 
primary  aircraft  axes  motion  sensor:,  is  prohibitive,  data  derived  from 
existing  IMU  outputs  would  probably  b*  adequate  for  most  mishap  analyses 
(although  obviously  dependent  upon  a  functional  IMU).  LSI  is  presently 
using  derived  roll,  pitch,  and  yaw  rates  for  HUD  inputs  for  air-to-air 
use  in  j  foreign  fighter  aircraft  update  program. 
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Table  2.  General  Parameters  List 


l.A.  Dynamics  parameters 


1. 

Time 

2. 

Cal 

airspeed 

3. 

h  (altitude) 

4. 

Heading 

5. 

V  " 

X 

6. 

V 

y 

* 

Body  axes  velocities 

7. 

V  - 
z 

8. 

N  ^ 

X 

9. 

N 

y 

Body  axes  accelerations 

10. 

N  J 
z 

11. 

0  (pitch  attitude)  " 

12. 

<t>  (roll  attitude) 

►  Euler  angles 

13. 

i)>  (yaw  (A  heading))  j 

14. 

0  (pitch  rate) 

15. 

<t>  (roll  rate) 

16. 

4»  (yaw  rate) 

17. 

4>  (roll  acceleration) 

18. 

0  (sideslip) 

19. 

a  (a 

ngle  of  attack) 

20. 

h  (vertical  velocity) 

(from  ADC) 

21. 

V  ' 

X 

] 

22. 

V  ' 

y 

►  Earth 

reference  velocities 

23. 

V  ' 
z 

J 

24. 

0.  A 

T. 

25. 

Weight  and  balance 

26. 

^lach  no. 

27. 

Latitude  and  longitude 
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Table  2.  General  Parameters  List  (Continued) 


l.B.  Flight  control  systems  parameters 

Primary 

1.  6  (rudder(s)  position) 

K 

2.  6  (horizontal  tail(s)  position) 

HI 

3.  6^  (aileron(s)  position) 

4.  F_  (rudder  pedal  force  (or  position)) 

K 

5.  F  (longitudinal  stick  force  (or  position)) 

h 

6.  F  (lateral  stick  force  (or  position)) 

Pi 

7.  Trim  X 

8.  Trim  Y 

9.  Trim  Z 

10.  Status  discretes 

Secondary 

1.  Flaps  position 

2.  Slats  (L.E.F.)  position 

3.  Speed  brake  or  spoiler  position 

4.  Wing  sweep  angle 

5.  Flap  handle  position 

6.  Slat  position  command 

7.  Speed  brake  command 

8.  Sweep  angle  command 


Table  2.  General  Parameters  List  (Continued) 

CAS  &  SAS 

1.  Roll,  pitch,  yaw  monitor  and  status 

2.  Paddle  switch  actuation 

3.  Autopilot  status 

l.C.  Power  plant  (jet,  turboprop)  parameters 

I.  RPM  (Nj  N2,  propeller) 

2  EGT,  FT IT,  ITT 

3.  CDP,  EPR 

4.  Vane  position  CIW,  RCW 

5.  Nozzle  position 

6.  Thrust  reverser  position 

7.  Throttle  position 

8.  Afterburner  status 

9.  Torque 

10.  Oil  pressure 

II.  Oil  quantity 

12.  Fuel  flow 

13.  Fuel  pressure 

14.  Oil  temp 

15.  Fuel  temp 

16.  Hydraulic  pressure 

17.  Hydraulic  oil  level 

18.  Utility  hydraulic  pressure 

19.  Starters,  JFS  etc. 


20.  EPU  fuel 


Table  2.  General  Parameters  List  (Continued) 


l.C.  (Continued) 

21.  Chip  detector 

22.  Gear  box  temp 

23.  Vibration  sensors 

24.  Status  warning  discretes 

l.D.  Avionics  systems  parameters 

Only  some  avionics  systems  are  of  interest,  and  of 
those,  certain  limited  parameters  including  status,  BIT 
data,  and  bus  data  are  provided  by  the  central  computer. 

CADC 

1 . 

2. 

3. 

4. 

5. 

6. 

Radar 

1. 

2. 

3. 


Validity  status 
h  (altitude) 

Airspeed 
h  (vertical  velocity) 
a 

P 


(  Listed  in  l.A.  also 


Altitude 

Terrain  clearance  pitch  commands 
Functional  status 
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Table  2.  General  Parameters  List  (Continued) 


l.D. 

(Continued) 

IMU 

(INU, 

INS) 

1. 

Validity  status 

2. 

Ground  speed 

3. 

Inertial  true  airspeed 

AHARS 

1. 

Validity  status 

2. 

Roll  attitude  "'l  Listed  in  I.A.,  could  back 

3. 

Pitch  attitude  J  UP  IMU"derived  parameters 

4. 

Yaw  rate 

Fuel 

manaj 

cement  system 

1. 

Validity  status 

2. 

Fuel  per  tank  (internal  and  external) 

3. 

Balance  warning  signals 

4. 

Bingo  fuel 

5. 

Purge  system  status 

6. 

Pump  functions 

7. 

Engine  feed  tank  levels 

8. 

Some  parameters  listed  with  engine  section 

Table  2.  General  Parameters  List  (Continued) 


Central  or 

fire  control  computer 

1. 

Validity  status 

Many  of  the  derived  parameters  originating 

in  IMU,  AHARS,  CADC,  etc.  are  available  as 

Computer  MUX  Bus  outputs.  The  resultant 

desired  parameters  are  in  the  dynamics  list. 

The  computer  can  usually  select  from  between 

several  sources  and  provide  the  best  available 

data . 

l.E.  Weapons  stores  inventory  and  delivery  system  parameters 

1 . 

Pylon  stores  identification  and  inventory 

2. 

Gun  status 

3. 

Rounds  remaining 

4. 

Delivery  mode  selection 

5. 

Weapons  release  and  intervals 

6. 

Malfun.  t.ions 
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Table  2.  General  Parameters  List  (Continued' 


l.F. 

Miscellaneous  subsystems  parameters 

1. 

Landing  gear  position 

2. 

Landing  gear  control  position 

3. 

Antiskid  status  (or  wheel  rpm) 

4. 

Nose  wheel  steering 

5. 

Drag  chute  status 

6. 

Arresting  hook  status 

7. 

Flares  and  chaff  dispenser  status  and  count 

8. 

Comm,  status 

9. 

Transmit  keying 

10. 

Fire  lights 

11. 

Master  caution  light 

12. 

Halon  pressure 

13. 

Squat  switch 

14. 

Caution  panel  warning  lights 

15. 

Marker  beacon  passage 

16. 

Glide  slope 

17. 

Localizer 

18. 

Tacan  bearing 

19. 

DME 

20. 

Canopy  lock 

21. 

Internal  stores  doors  and  racks 

22. 

Anti-ice 

23. 

Accumulator  pressures 

24. 

Strain  gages 
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Table  2.  General  Parameters  List  (Continued) 


1 .  G. 

Environmental  parameters 

1. 

Cabin  temperature 

2. 

Cabin  altitude 

3. 

Oxygen  pressure 

4. 

Oxygen  remaining 

5. 

Oxygen  flow 

6. 

Equipment  cooling 

7. 

g  levels  (previously  listed) 

1  .H. 

Electrical  parameters 

1 . 

Gen  voltage  (AC) 

2. 

Gen  status  (AC) 

3. 

Bus  status  (may  be  4-5  discretes) 

4. 

28  VDC  gen  or  converter  voltage  and  status 

5. 

Emergency  gen  status 

6. 

APU,  EPU,  JFS  status  and  output 

7. 

Inverter  voltage 

8. 

Battery  voltage 
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Another  form  of  interrelationship  involves  parameters  of  the  same 
family.  For  example,  if  roll  attitude,  roll  rate,  and  roll  acceleration 
are  all  available,  should  all  three  be  recorded?  Presumably,  if  the 
roll  attitude  sensor  has  the  response  capability,  and  enough  samples  are 
recorded,  then  the  other  two  are  available  as  derivatives.  The  second 
(acceleration)  derivative  may  be  quite  noisy.  If  the  accelerometer 
output  is  used  instead,  and  integrated  twice,  the  error  in  attitude  will 
grow  rapidly  with  time  unless  the  sensor  and  electronics  approach  the 
quality  of  the  IMU  or  at  least  of  a  strapdown  system.  If  all  three  (or 
even  two)  are  available,  they  need  occupy  no  more  memory  space  in  the 
recorder  than  would  one  parameter  with  optimized  compression.  Since 
they  are  related  parameters,  a  small  amount  of  preprocessing  under 
software  control  requires  only  recording  a  starting  or  reference  atti¬ 
tude,  a  time-related  peak  acceleration,  the  slope  (or  rate)  when  stab¬ 
ilized,  and,  again,  the  attitude  at  the  inflection  point  (slope  zero  and 
maximum  acceleration).  This  simple  linear  differential  relationship 
permits  accurate  motion  reconstruction  with  a  minimum  number  of  data 
points.  The  position,  rate  and  acceleration  can  be  derived  from  a  single 
sensor  through  preprocessing  and  recorded  in  the  same  manner  (with  less 
final  accuracy).  A  third  example  can  be  demonstrated  by  choosing  one 
axis  (such  as  lateral)  of  a  relatively  complex  control  system  of  a 
modern  fighter  aircraft.  There  is  no  direct  feel  of  the  pressure  on  an 
aileron  reflected  back  to  the  stick.  There  exists  a  rather  complex 
system  of  mechanical  hydraulic  and  electrical  control  along  with  emer¬ 
gency  backup,  Q  controlled  gain  changes,  automatic  trim  changes,  arti- 
fical  feel,  etc.  The  desire  is  to  determine  control  stick  inputs  vs. 
aileron  output.  i’his  could  involve  linear  output  transducers  for  each 
signal  and  up  to  20  resolution  steps  for  each  parameter  to  be  recorded. 
Also  recorded  would  be  CAS/SAS  status,  failure  discretes,  etc. 

The  known  relationship,  under  all  normal  operating  conditions,  of 
the  stick  position  and  preasure  vs.  aileron  position  can  be  used  to 
reduce  the  data  samples  to  be  recorded.  The  stick  pressures  can  be 
sampled  in  twenty  increments  (plus  and  minus),  while  the  aileron  posi¬ 
tion  can  be  inferred  in  normal  operation.  Further  verification  of 
aileron  motion  can  be  deduced  by  roll  rates  induced.  There  are,  how¬ 
ever,  certain  maneuvers  or  failure  conditions  where  the  inferred  data 
may  be  wrong.  To  preclude  this,  the  aileron  position  can  be  recorded  in 
much  lower  resolution  steps  than  the  stick,  and,  in  most  cases,  the 
intervening  positions  can  then  be  interpolated  adequately.  A  more 
sophisticated  approach  providing  a  further  reduction  in  data  recorded 
during  normal  operation  is  to  model  the  expected  aileron  positioning  in 
respect  to  inputs  such  as  stick  position  and  gain  change  and  failure 
discretes,  and  to  record  aileron  position  only  when  it  does  not  conform 
to  the  model.  Once  it  is  outside  of  the  model  envelope  it's  position 
would  be  incrementally  recorded.  Many  dynamics,  flight  control  and 
engine  parameters  are  candidates  for  the  modeling  method. 
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3.1.1. A  Minimized  general  list  -  Table  3  is  the  general  list  from 
table  2  reduced  to  contain  the  minimum  number  of  parameters  assumed  to 
be  adequate  for  most  accident/mishap  investigations.  It  is  organized  in 
the  same  parameter  type  sequence  as  table  2. 

Each  category  consists  of  three  lists.  The  first  list  represents 
those  parameters  inputted  to  and  monitored  by  the  recorder  subsystem 
some  of  which  are  recorded.  The  second  list  is  of  parameters  which  can 
be  derived  from  the  recorded  ones  during  ground  playback  and  post¬ 
processing.  The  third  list  consists  of  those  minimum  parameters  deemed 
necessary  for  post-crash  analysis.  The  lists  are  not  prioritized  at 
this  point  in  the  analysis. 

3. 1.1.5  Prioritization  and  selection  methods  -  It  is  desirable  to 
format  parameter  lists  in  descending  order  of  importance.  By  placing 
the  lowest  priority  parameters  at  the  bottom  of  the  list,  they  may  be 
lopped  off  as  necessary  to  reduce  the  list  to  manageable  size.  This 
approach  is  a  good  goal,  but  many  parameters  can  be  better  prioritized 
in  groups  (e.g.,  the  groupings  used  in  earlier  paragraphs  such  as: 
dynamics,  engine,  flight  controls,  etc.).  A  comprehensive  list  will 
contain  many  parameters  of  each  group.  Engine  parameters,  as  a  group, 
may  be  expanded  or  reduced  as  may  the  dynamics  parameters.  Listing  by 
group  makes  it  easier  to  tailor  the  lists  to  specific  aircraft  and 
application.  In  a  final  minimum  list  that  may  fit  within  a  small  size 
of  recorder  memory,  a  particular  parameter  may  be  very  important,  whereas, 
it  may  have  been  easily  derivable  from  other  parameters  in  the  expanded 
list  and,  therefore,  of  low  recording  priority  in  the  expanded  list. 

Table  A  is  a  work  sheet  used  to  derive  a  composite  of  previously 
prioritized  lists  such  as  the  National  Transportation  Safety  Board 
(typical  for  transport  aircraft),  the  parameter  preference  lists6 
compiled  by  Norton  AFB  for  the  A-10,  F-15,  and  F-16  accidents  and  a 
priority  list  made  up  from  221  Class-A  accidents  for  A/F/T  aircraft. 

The  statement  of  ne>*d  f,SON)  list  ranking  is  compared  with  the  composite 
list  (last  column  of  table  A,  "Composite  Priority  List  Work  Sheets"). 

There  is  very  little  resemblance  in  the  ranking  of  the  two  lists.  The 
most  asked  for  parameters  appear  to  be  completely  random  in  respect  to 
category  or  source  of  the  parameter  as  might  be  expected.  Most  of  the 
"source"  lists  follow  a  particular  order,  generally  with  dynamics  param¬ 
eters  followed  by  flight  control  parameters  and  engine  parameters,  then 
others.  Table  5  presents  the  composite  priority  list  in  ranking  order 
for  a  comprehensive  list,  prepared  to  prevent  omission  or  oversight 


6Letter  from  Philip  J.  Greeley,  Col  USAF,  Dated  7  October  1980,  to 
Lear  Siegler ,  Inc . 
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Table  3.  Minimized  General  Parameters  List 


Table  3.  Minimized  General  Parameters  List  (Continued) 


(2)  Ground  station  processor  output 

>•  v*  i 


2. 

V 

y 

3. 

V  - 
z 

) 

4. 

“0 

5. 

\  1 

I 

6. 

N  J 

z 

7. 

0  (pitch  attitude)  ‘'l 

8. 

<t>  (roll  attitude)  j 

9. 

(yaw  (A  heading))  J 

10. 

0  (pitch  rate)^ 

11. 

4>  (roll  rate) 

12. 

»j<  (yaw  rate)  J 

13. 

(roll  acceleration) 

14. 

0 

15. 

a 

16. 

Heading 

17. 

Grour.j  track 

(or 

lat./long. ) 

18. 

Mach 

no . 

19. 

Altitude 

20. 

Cal 

airspeed 

21. 

Vertical  velocity 

22. 

Time 

23. 

Total  fuel 

Body  axis  translatory 
velocities  (derived)  (IMU) 


Body  axis  translatory  acceler¬ 
ations  (derived)  (IMU) 

Direct  (IMU  or  AHARS) 

Derived  (direct  if  available) 

Derived  (direct  if  available) 

Direct  |  (or  derived,  possible 

.  |  high  error) 

Direct J 

Direct 

Direct 

Derived 

Direct  (IMU  or  CADC) 

Direct  (ADC) 

Direct  (V  ’  or  CADC) 

Z 

Direct 

Direct 
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Table  3.  Minimized  General  Parameters  List  (Continued) 


Table  3.  Minimized  General  Parameters  List  (Continued) 


2.B. 

Flight  control  systems  parameters 

(1) 

Input 

to  recorder  preprocessor 

1. 

6r 

2. 

6ht 

3. 

6a 

4. 

fr 

5. 

fe 

6. 

fa 

7. 

Pitch 

trim 

8. 

Status  discretes  of  CAS/SAS 

9. 

Slats 

on  LEF  open/closed  discrete 

10. 

Flaps 

up/down  discrete 

11 . 

Wing 

sweep  when  applicable  (F- 111) 

12. 

Speed  brake  open/close  discrete 

Preprocess 

ing  philosophy  suggests  no  need  to  record  any  of  the 

above 

variables  1- 

6  unless  the  status  discretes  indicate  failure 

modes 

,  or 

if  aircraft  motion  sensors  indicate  high  acceleration 

or  rates  above  predetermined  thresholds. 

Table  3.  Minimized  General  Parameters  List  (Continued) 


(2)  Typical  recorded  flight  control  data  available  to 
ground  processor 


1. 

2. 

3. 

4. 

5. 

6. 

7. 

8. 
9. 
10 
11 


12. 


Pitch  trim  position  when  changed 
Wing  sweep  position  (where  applicable) 

FCS  CAS/SAS  status  discretes  when  changes  occur 
Slat  position  when  changed 
Flap  position  when  changed 

Only  when  pre-defined  criteria  are  met 

Only  when  exceed  preprocessor  model 
or  tolerances 

Speed  brake  when  changed 


Very  little  flight  control  data  will  be  recorded  unless 
failures  or  turbulent  flight  occur. 

(3)  Most  important  flight  control  parameters 

1.  Pitch  trim  (seme  aircraft) 

2.  FCS  status  and  failure  discretes 

3.  Slat  or  flap  position  (specific  aircraft) 


5. 

6. 


Table  3.  Minimized  General  Parameters  List  (Continued) 


Can  be  reconstructed  from  input  data 
and  model  used  in  preprocessor  or 
recorded  data  when  model  exceeded 

Where  recording  capacity  is  limited,  control  surface  position 
may  be  deduced  from  control  inputs  and  aircraft  response  in 
most  cases. 


Power 

plant  parameters 

(1) 

Input  to  recorder  ] 

preprocessor 

1 . 

RPM  (N t  or  N2) 

(Record  predetermined 

increments 

2. 

EGT,  FTIT  or  ITT 

(Record  predetermined 

increments 

3. 

Throttle  position 

(Record  predetermined 

increments 

4. 

Nozzle  position") 

Model  in  preprocessor 

and  record 

5. 

Fuel  Flow  J 

only  if  outside  model 

limits 

6. 

Vibration  sensor 

(Requires  special  conditioning) 

7. 

Fire  light 

(discrete) 

8. 

CDP  or  EPR 

If  available  (Reco -d 

increments) 

9. 

Oil  pressure 

Record  increments 

10. 

Hydraulic  pressure 

Record  increments 

11. 

Afterburner  status 

(2) 

Typical  recorded  power  plant  data 

1 . 

RPM 

2. 

FTIT 

3. 

Throttle  position 

U. 

Nozzle  position 

Table  3.  Minimized  General  Parameters  List  (Continued) 


5. 

Fuel  Flow 

6. 

Vibration  sensor 

(Only  certain  changes) 

7. 

Fire  light 

(Only  in  the  event  of  Fire) 

8. 

CDP  or  EPR 

(Only  available  on  some  aircraft) 

9. 

Oil  pressure 

(Record  fail  discrete) 

10. 

Hydraulic  pressure 

(If  out  of  normal  range) 

11. 

Afterburner  status 

(3) 

Most  important  power 

plant  data  available  for  analysis 

1. 

RPM 

(Actual) 

2. 

FTIT 

(Actual) 

3. 

Throttle  position 

(Actual) 

4. 

Nozzle  position^ 

Available  from  model  or  actual 

5. 

Fuel  flow  J 

if  excessive  deviation  from  model 

6. 

Fire  light 

Discrete  indications 

7. 

Oil  pressure  J 

of  problems 

8. 

CDP  or  EPR 

(Actual  if  available) 

9. 

Afterburner  status 

(Derived  from  other  parameters) 

10. 

Hydraulic  pressure 

(If  abnormal) 

Typical  flights  would  only  record  three  or  four  power  plant 
variables,  and  then  only  when  certain  deltas  are  exceeded. 


Table  3.  Minimized  General  Parameters  List  (Continued) 

.  D.  Avionics  systems  parameters 

(1)  Input  to  recorder  preprocessor  (parameters  listed 
with  other  sources  will  not  be  relisted  unless 
they  provide  backup  or  alternate  sources) 

1.  CADC  validity  status  or  words 

2.  Vertical  velocity  (CADC  alternate  source) 

3.  a  (alternate  source) 

4.  (5  (alternate  source) 

5.  IMU  validity 

6.  AHARS  validity 

7.  Roll  attitude  (AHARS  backup) 

8.  Pitch  attitude  (AHARS  backup) 

9.  Yaw  rate  (AHARS  backup) 

11.  Roll  rate  (HUD  source  backup) 

12.  Yaw  rate  (HUD  source  backup) 

13  Pitch  rate  (HUD  source  backup) 

14.  Central  computer  (FCC)  status  word 

(2)  Recorded  avionics  systems  data 

1.  CADC  status  and  validity  (Only  if  abnormal) 

AHARS  status  and  validity  (Only  if  abnormal) 

FCC  status  and  validity  (Only  if  abnormal) 

IMU  status  and  validity  (Only  if  abnormal) 


2. 

3. 

4. 


Table  3.  Minimized  General  Parameters  List  (Continued) 


(3)  Most  important  avionics  parameters.  The  most 
important  avionics  parameters  in  the  list  of 
2.D.  are  the  validity  indications  for  avionics 
subsystem  parameters  being  recorded.  These  will 
amount  to  an  average  of  four  to  five  digital 
discretes  for  each  subsystem  contributing  data 
(with  about.  15  total). 

E.  Weapon  stores  and  inventory  parameters  (also  external 

fuel  tanks) 

(1)  Input  to  recorder  preprocessor 

1.  Rounds  remaining 

2.  Stores  status  for  each  pylon  or  station 

(type  of  weapon  on  stations  can  be  logged 
when  installed,  eliminating  the  need  to 
record. ) 

(2)  Recorded  stores  data  available  to  ground  station 


2. 


Data  logged  when  weapons  loaded 

Stores  dropped  or  fired  per  station  (with  time) 


Table  3.  Minimized  General  Parameters  List  (Continued) 


(3) 

Minimum  stores  data  recorded 

1 . 

Stores  fired  or  dropped  from  one  wing  tip 

to 

fuselage  centerline  (acceptable  where  the 

number 

of  recorded  parameters  are  limited  since 

stores 

are  dropped  or  fired  from  alternate  sides 

to 

maintain  symmetry). 

2. 

Hung  stores  status 

2.F.  Miscellaneous  subsystems  parameters 

(1) 

Input  to  recorder  preprocessor 

1. 

Master  caution 

2. 

Transmitter  keying 

3. 

Canopy  lock  (cargo  or  hatch  door) 

4. 

Anti-ice  status 

5. 

Landing  gear  position 

6. 

Weight  on  gear 

7. 

Antiskid 

(2) 

Typical  recorded  miscellaneous  parameters 

available 

to  ground  processor  (same  as  in  2.F.(l)) 

(3) 

Most  important  miscellaneous  parameters 

1 . 

Master  caution 

2. 

Landing  gear  status 

3. 

Weight  on  gear 
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Table  3.  Minimized  General  Parameters  List  (Continued) 

2.G.  Environmental  parameters 

(1)  Input  to  recorder  preprocessor 

1.  Cabin  temperature  (to  be  recorded  only  if  out  of  normal 

range) 

2.  Cabin  altitude  (model  against  outside  altitude  and 
record  only  if  out  of  model  limits)  (only  if  trans¬ 
ducer  available) 

3.  Oxygen  remaining 

(2)  Typical  recorded  data  available  to  ground  station 

1.  Cabin  temperature 

2.  Cabin  altitude  (derived  from  model  or  actual  if 
out  of  tolerance) 

3.  Oxygen  remaining  (actual) 

(3)  Most  important  environmental  parameters 


1. 


Oxygen  remaining 


Table  3.  Minimized  General  Parameters  List  (Continued) 


Electrical  parameters 

(1;  Input  to1 recorder  preprocessor 

1.  AC  main  bus  voltage 

2.  Main  alternator  status 

3.  Backup  alternator  status 

4.  Emergency  power  unit  status 

5.  DC  bus  voltage 

6.  Battery  voltage  or  status 

7.  Various  buses'  status 

8.  26  VAC  instrument  bus  voltage 

(2)  Typical  recorded  data  to  ground  station 

1.  AC  voltage  (if  out  of  normal  limits) 

2.  Power  source  (main  generator,  emergency  generator,  etc.) 

3.  DC  voltage  (if  out  of  normal  limits) 

4.  Battery  voltage  (if  all  other  DC  power  down) 

(3)  Most  important  electrical  parameters 

1.  AC  power  available  and  within  limits 

2.  DC  power  available  and  within  limits 


Table  4.  Composite  Priority  List  Work  Sheets 
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:k  Sheets  (Continued) 
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Sheets  (Continued) 


Table  4.  Composite  Priority  List  Work  Sheets  (Continued) 


Table  4.  Composite  Priority  List  Work  Sheets  (Continued) 
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Table  5.  Composite  General  Parameters  Priority  List 


Table  5.  Composite  General  Parameters  Priority  List  (Continued) 


RANK 

ID  NO.  TABLE  4 

NAME 

29 

4.10 

Rudder  ped.  position  or  force 

30 

2.5 

Mach  no. 

31 

1.4 

Radar  altitude 

32 

3.7 

Afterburner  position 

33 

3.9 

Pitch  rate 

34 

4.6 

Pitch  trim  position 

35 

6.2 

Pitch  SAS  status 

36 

3.10 

Roll  rate 

37  (2) 

4.5,  4.7 

Roll  and  yaw  trim  position 

38 

2.3 

Sideslip  angle 

39 

5.14 

Utility  hydraulic  pressure 

40 

4.15 

Speed  brake  or  spoiler  position 

41 

5.16 

Alt./Inv./Gen.  output 

42 

5.15 

FTIT 

43 

5.17 

APU/EPU/JFS  status 

44  (see  18) 

4.11 

Flap  or  Flaperon  position 

45 

1.1 

Transmitter  keyed 

46 

2.6  (8.9) 

CADC  status 

47 

2.8  (3.12) 

Vert,  velocity 

48 

8.14 

SAS/CAS  status  light 

49 

2.7 

0.A.T./I.A.T. 

50 

6.7 

Paddle  switch 

51 

3.7 

Longitudinal  accel. 

52 

6.4 

Autopilot  ON/OFF 

53 

3.6 

Lateral  accel. 

54 

3.4 

Yaw  angle 

55 

7.4 

Cabin  pressure 

56  (2) 

6.5,  6.6 

Alt.  or  Att.  hold,  turn  rate  or  heading 

Table  5.  Composite  General  Parameters  Priority  List  (Continued) 


RANK 

ID  NO.  TABLE  4 

NAME 

57 

4. 16 

Gear  position 

58 

4.18 

Wing  sweep  angle 

59 

5.9 

Oil  quantity 

60 

8.15 

Squat  switch 

61 

7.5 

Cabin  temperature 

62 

8.16 

Marker  beacon  passage 

63 

8.17 

Localizer 

64 

8.8 

FCC  status 

65 

8.18 

Glide  slope 

66 

5.21 

Fuel  pressure 

67 

- 

Oil  chip  detector 

68 

1.3 

Anti-skid 

69 

1.5 

Halon  pressure 

70 

3.11 

Inertial  altitude 

71 

4. 17 

Gear  handle  position 

72 

4. 14 

Slat  command  position 

73 

4. 12 

Flap  handle  position 

74 

7.1 

Oxygen  flow 

75 

7.2 

Oxygen  pressure 

76 

7.3 

Oxygen  quantity 

77 

5.22 

Fuel  temp. 

78 

5.20 

Thrust  reverser 

45 
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of  parameters.  The  lists,  by  category,  are  the  best  starting  point. 

The  comprehensive  ranked  parameter  list  is  useful  for  empirically 
realized  relative  worth  of  the  various  parameters.  However,  it  does  not 
directly  follow  that  a  minimum  list  can  be  prepared  by  lopping  off  the 
bottom  of  the  comprehensive  list.  No  minimum  list  is  meaningful  unless 
prepared  for  a  specific  aircraft.  The  parameter  selection  may  then  be 
biased  in  the  direction  that  existing  accident  investigations  dictate. 
Caution  here  is  also  advised  since,  as  causes  are  corrected,  accidents 
will  tend  to  shift  toward  a  random  cause,  and  the  parameters  monitored 
should  be  general  enough  to  shed  light  on  a  variety  of  causes. 

3. 1.1. 6  Parameter  types  -  Parameters  can  be  source  related.  In 
this  study,  the  sources  or  names  of  sources  may  vary  slightly  with 
aircraft  type  but  are  essentially  as  listed: 

•  Engine 
CADC 

FCS  (CAS,  SAS) 

AHARS 
INS  (IMU) 

•  Master  bus  controller 

•  Fire  Control  (or  Central)  Computer 
HUD 

SAS 

•  Aircraft  miscellaneous 

•  SMS  (Stores  Management  System) 

The  parameter  data  may  be  supplied  from  the  following  signal  types: 

•  1553  Data  bus  (or  equivalent) 

Digital  data 
Digital  discretes 

•  Synchro 

•  Other  AC  analog 

•  DC  analog 

•  +28  VDC  discretes 

•  Low  level  complementary  discrete 

•  Variable  frequency 

•  AC  discretes 

Tables  are  provided  for  the  A-10,  F-15,  and  F-16  parameters  and 
include  source,  description,  and  parameter  data  specifications.  These 
tables  are  included  in  3. 1.1.8. 


a  «. .  .  ..  |M| 


46 


- 


- -  AA  - 


3 . 1 . 1 . 7  Existing  sensors  and  data  sources  vs.  added  sensors  and 
signal  sources  -  For  the  most  economical  recorder  installation  and 
implementation,  it  is  desirable  to  obtain  the  parameter  data  from  exist¬ 
ing  in-place  sources  when  possible.  The  most  economical  source  is  the 
MUX  bus.  If  the  existing  signal  is  inadequate  for  accident/mishap 
analysis  purposes,  first  alternative  parameters  must  be  investigated  as 
possible  sources  of  derivable  data,  or  new  sensors  must  be  added  for 
direct  data  acquisition.  Addition  of  new  sensors  also  means  addition  of 
new  mounting  and  wiring  kits  along  with  the  extra  installation  time. 

When  existing  sources  are  marginal,  a  trade-off  must  be  made  as  to 
whether  to  accept  limited  data  or  to  add  the  new  sensor  at  additional 
cost.  The  lists  provided  for  the  A-10,  F-15,  and  F-16  assume  use  of 
existing  signals  where  possible.  Sensors  are  added  only  as  a  last 
resort.  The  previously  given  comprehensive  list  (table  5)  was  priori¬ 
tized  strictly  on  the  basis  of  usefulness,  need,  or  request.  Other 
items  that  can  or  should  affect  ranking  of  parameters  are  the  items  that 
dictate  cost  effectiveness  of  each  parameter;  that  is,  the  need  must  be 
weighed  against  the  cost  of  acquisition.  Some  basic  parameters  must,  of 
course,  be  recorded  anyway. 

The  following  characteristics  should  be  known  for  each  parameter 
and/or  source  to  assist  in  determining  the  most  effective  selection. 

•  Relative  need  (priority  from  general  list) 

•  Relative  cost  of  acquisition  (size,  weight,  price, 
i nsta 1 ! ation) 

•  Complexity  (signal  processing  complexity,  etc.) 

•  Safety  (impact  on  existing  systems) 

•  Reliability  of  source  (leading  to  or  during  mishap) 

•  Maintainability  (added  maintenance  cost  vs.  none  added  if 
existing  sources  used) 

The  policy  followed  in  formulating  the  A-10,  F-15,  and  F-16  lists 
is  not  to  re-iank  parameters  as  these  last  considerations  are  evaluated, 
but  rather  to  provide  each  parameter  with  a  figure  of  merit  of  from  1  to 
5  for  each  characteristic.  A  rating  of  1  being  least  desirable  and  a  5 
being  most  desirable. 
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3. 1.1.8  Lists  for  specific  aircraft  -  Representative  lists  have 
been  prepared  for  the  A-10,  F-15,  and  F-16.  The  lists  are  intended  to 
be  accurate  enough  to  provide  data  requirement  recommend-tions  and 
inputs  to  other  sections  of  the  study  for  installation  planning  and  cost 
trade-offs.  Multiple  sources  of  some  parameters  exist  and  the  one 
chosen  for  the  list  might  not  be  the  one  used  in  an  actual  design  effort. 
Availability  points  in  the  aircraft  are  given  to  identify  the  source, 
but  are  not  necessarily  given  to  physically  show  where  connections  would 
be  made. 

a.  A-10.  Table  6,  the  A-10  priority  list  in  accordance  with 
parameters  requested  by  accident  investigators  (reference  6),  is  included 
to  show  the  relative  importance  of  various  parameters  for  A-10  accident 
investigations  as  indicated  by  the  investigators  themselves  (question¬ 
naire  tabulation).  The  list  shows  49  parameters  divided  into  12  groupings 
of  descending  priority.  Time,  though  of  low  priority  on  their  list  was 
placed  at  the  top.  The  percentage  of  time  that  a  parameter  was  requested 
is  shown  in  the  fourth  column. 

The  ranking  as  shown  in  the  general  priority  list  (table  5)  is 
entered  in  column  5  for  relative  comparison. 

Table  7  is  the  final  recommended  arrangement  of  parameters  and  is 
presented  as  the  Configuration  I  list  for  the  A-10.  It  is  expanded  to 
list  parameters  for  each  engine  and  control  surface,  and  is  rearranged 
to  move  some  high  priority  parameters  from  the  general  list  to  higher 
spots  relative  to  the  A-10  investigators'  list.  The  Configuration  I 
list  must  be  comprehensive  and  general  enough  to  permit  analysis  of 
accidents  from  almost  any  cause.  Minimum  lists,  by  necessity,  often 
tend  to  be  biased  toward  parameters  useful  in  analyzing  the  most  recent 
and  most  common  accidents  for  that  aircraft  to  date.  This  trend  should 
be  guarded  against  in  a  long-term  crash  recorder  program.  Where  desired 
data  is  available  from  a  MUX  bus,  reprogramming  of  the  recorder  provides 
flexibility  for  priority  shifting.  Where  sensors  must  be  added  for  con¬ 
centrated  special  area  monitoring,  changes  are  costly.  Forty-four  "con¬ 
tinuous"  signals  and  61  discrete  signals  are  listed.  They  are  priori¬ 
tized  separately  because  their  processing  and  memory  requirements  are 
drastically  different.  Many  discretes  can  be  recorded  for  the  "price" 
of  one  continuous  signal.  Table  8  is  the  recommended  minimum  parameter 
list  for  the  A-10.  An  attempt  has  been  made  to  balance  parameter  needs 
for  long-term  general  accident  analysis  with  those  determined  by  the 
"to-date"  needs.  Explanations  of  special  problems  of  some  parameters 
follow  each  table  as  necessary. 
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Table  6.  A-10  Investigators'  List 


No. 

Parameter 

Ranking 

Group 

Request 

% 

General 

List 

Ranking 

1 

T  ime 

9 

18 

2 

a 

Yaw  rate 

1 

71 

6 

D 

Bank  attitude 

2 

65 

10 

a 

Pitch  attitude 

2 

65 

8 

5 

Slat  position 

2 

65 

20 

6 

Rudder  position 

2 

65 

14 

7 

AOA 

3 

59 

24 

8 

Aileron  ,  , 
position 

3 

59 

18 

9 

N,  (2) 

4 

53 

9 

10 

Baro.  alt. 

4 

53 

4 

11 

StiC^.  (2) 
position 

4 

53 

17 

12 

(2) 

pres. 

4 

53 

27 

13 

Master  caution 

4 

53 

7 

14 

Cal.  a i rspeed 

5 

47 

1 

IS 

Norm,  load 

5 

47 

13 

16 

Speedbrake 

position 

5 

47 

40 

47 


23 


Table  6.  A- 10  Investigators'  List  (Continued) 


No. 

Parameter 

Ranking 

Group 

Request 

% 

General 

List 

Ranking 

18 

N2  (2) 

5 

47 

5 

19 

EGT  (2) 

5 

47 

12 

20 

CAS  roll 

5 

47 

16 

21 

Trim  (3) 

5 

47 

34, 

37 

22 

Rudder  ped. 
porition 

6 

35 

29 

23 

CAS  pitch 

6 

35 

35 

24 

CAS  yaw 

6 

35 

21 

25 

Throttle  . 

position  ^ 

7 

29 

11 

26 

Util.  hyd. 
pressure 

7 

29 

39 

27 

1 

Futl  (2) 
flow 

8 

24 

3 

28 

Oil  (2) 

pressure 

8 

24 

28 

29 

Gen.  (2) 

8 

24 

41 

30 

Kacn  nn. 

9 

18 

30 

31 

Heading 

9 

18 

25 

32 

Flap 

position 

9 

18 

44 

50 


Table  6.  A-10  Investigators’  List  (Continued) 


Source  Code:  1.  1553  data  bus  5.  INS  ).  Engine  Type  Code:  1.  Synchro  5.  Oigital  i 

2.  CAT'C  6.  Master  bus  controller  10.  Added  sensors  2.  *2BV  discrete  6.  Low  levc 

J.  F.C.S-  (CAS.SAS)  7.  KUO  3.  O.C.  analog  7-  AC  analoj 

4.  AllARS  A.  Acft.  ■  isc.  U.  Oigital  discrete 


Table  7.  A-10  Configuration  I  Parameter  List  (Continued) 


Table  7.  A-10  Configuration  I  Parameter  List  (Continued) 
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Source  Code:  1.  1553  data  bus  5-  INS  9.  Engine  Type  Code:  1.  1,/ncliro  5.  Digital  data 

2-  CADC  6.  Master  bus  controller  10.  Added  sensors  2-  +28V  discrete  6.  Low  level  comp-  discrete 

3.  F-C-S-  (CAS.SAS)  7-  HUD  3-  D-C.  analog  7-  AC  analog 

4-  AHARS  8-  Acft-  misc.  4-  Digital  discrete 


Table  7.  A-10  Configuration  I  Parameter  List  (Continued) 


.-I  at  i  vo  Figures  of  M**nt:  0  “  Lowest  Merit;  r>  -  Highest  Merit 


Table  7.  A-10  Configuration  I  Parameter  List  (Continued) 


Table  7.  A-10  Configuration  I  Parameter  List  (Continued) 


Sont«e  C  «»•!** :  1.  isrjj  data  bus  *» .  IMS  9.  Engine  Type  Code:  1.  Synchro  5.  Digital  data 

2.  CADC  .  Master  bus  controller  It).  Added  sensors  2.  +2RV  discrete  6-  bow  level  romp,  discrete 

3-  I-  C.S.  (CAS.SAS)  7.  MUD  3.  D.C.  analog  7.  AC  analog 

U.  AMAHS  fi.  At  ft.  wise.  A  Digital  discrete 


Table  7.  A-10  Configuration  I  Parameter  List  (Continued) 


„<|o:  1  I'jSJ  .lata  Inis  V  INS  ').  r.iiRi  ne  Type  Cmle :  I  Synchro  r> .  Digital  Hita 

2,  CADC  6.  Master  hits  controller  10.  Aifileii  sensors  2.  +  2RV  ilisrrete  fi .  I.ow  level  cm 

I  F.C.S.  ICAS.SAS)  7.  Hill)  1  DC.  analog  7.  AC  nil  I  OR 

U.  AIIAHS  H  A.  It  nil  Si  4.  Digital  ills,  rele 


Relative  Figure*  of  Merit:  0  =  Lovett  Merit;  5  =  Highest  Merit 


Table  8.  A-10  Configuration  II  Parameter  List 


NO. 

PARAMETER  (CONTINUOUS) 

NO.  ON 
CONFIG. I 
LIST 

A-10 

ACC.  LIST 
PRIORITY 

1 

Time 

1 

y 

2 

Cal  airspeed 

2 

5 

3 

Normal  load 

3 

5 

4 

Press  altitude 

4 

4 

5 

Bank  angle 

5 

2 

6 

Pitch  attitude 

6 

2 

7 

Yaw  rate 

7 

1 

8 

AOA 

8 

3 

9 

Rudder  position  (rt) 

9 

2 

10 

Rudder  position  (It) 

10 

2 

mm 

Aileron  position  (rt) 

11 

3 

EB 

Aileron  position  (It) 

12 

3 

13 

Elevator  position  (rt) 

13 

5 

14 

Elevator  position  (It) 

14 

5 

15 

Stick  position  (roll) 

15 

4 

16 

Stick  position  (pitch) 

16 

4 

mm 

N !  (rt) 

17 

4 

N i  (It) 

18 

4 

ITT  (rt) 

21 

5 

20 

ITT  (It) 

22 

5 

21 

Rudder  ped  position 

25 

6 

Table  8.  A-10  Configuration  II  Parameter  List  (Continued) 


NO. 

PARAMETER  (CONTINUOUS) 

NO.  ON 
CONFIG. I 
LIST 

A-10 

ACC.  LIST 
PRIORITY 

22 

Throttle  position  (rt) 

26 

7 

23 

Throttle  position  (lt) 

27 

7 

24 

Fuel  flow  (rt) 

28 

8 

25 

Fuel  flow  (lt) 

29 

8 

26 

Flap  position 

36 

9 

27 

True  heading 

30 

9 

28 

Roll  rate 

31 

- 

29 

Pitch  rate 

32 

- 

NO. 

PARAMETER  (DISCRETES) 

NO,  ON 
CONFIG. I 
LIST 

A-10 

ACC.  LIST 
PRIORITY 

1 

Slat  position  (rt) 

1 

2 

2 

Slat  position  (lt) 

2 

2 

3 

Master  caution  light 

3 

4 

4 

7-10  percent  speed  brake 

4 

5 

5 

80  percent  speed  brake 

5 

5 

6 

Lt  ail .  jam  light 

7 

5 

7 

Lt.  ail.  disengage 

8 

5 

8 

Rt.  ail.  jam  light 

9 

5 

9 

Rt.  ail.  disengage 

10 

5 

10 


Lt.  elev  jam  light 


14 


6 


Table  8.  A-10  Configuration  II  Parameter  List  (Continued) 


NO. 

PARAMETER  (DISCRETES) 

NO.  ON 
CONFIG. I 
LIST 

A-10 

ACC.  LIST 
PRIORITY 

11 

Lt  elev  disengage 

15 

6 

12 

Rt  elev  jam  light 

1 

6 

6 

13 

Rt  elev  disengage 

1 

7 

6 

14 

Ail  disengage  caution 
light 

11 

5 

15 

Elev  disengage 
caution  light 

18 

6 

16 

Left  hyd  pres  switch 
CAVT  light 

1 

19 

6 

17 

Right  hyd  pres  switch 
CAVT  light 

20 

6 

18 

Pitch  SAS  caution  ’ ight 

27 

11 

19 

Yaw  SAS  caution  light 

26 

11 

20 

Left  fire  light 

28 

10 

21 

Right  fire  light 

O 

i. 

9 

10 

22 

APU  fire  light 

30 

10 

23 

Paddle  switch 

31 

9 

24 

GAU-8  trigger  signal 

35 

- 

25 

GAU-8  unsafe  light 

37 

- 

26 

Weight  on  wheels 

38 

- 

27 

Left  DC  bus  status 

49 

8 

28 

Right  DC  bus  status 

8 

The  following  is  an  explanation  of  certain  parameters  in  table  7. 


No.  3.  Normal  load  (aircraft  z  axis  acceleration).  This  parameter 
can  be  obtained  from  the  INS  word  101  (not  used  in  the  A-10  but  on  the 
MUX  bus  in  the  normal  mode).  To  obtain  it,  all  three  inertial  axes 
accelerations  and  the  Euler  angles  must  be  either  recorded  for  later 
conversion,  or  the  conversion  must  be  done  in  the  crash  recorder  prepro¬ 
cessor  before  recording.  The  latter  saves  memory  but  requires  greater 
processing  capability  (preferred).  It  is  unavailable  if  the  INS  has 
failed. 

An  alternate  source  is  the  linear  accelerometer  which  supplies  the 
basic  input  to  the  accelerometer  counter  set  which  is  on  all  airplanes. 
It  is  understood  that  the  A-10  ASIP  recorder  does  not  use  this  signal  as 
does  the  F-15  but  has  its  own  accelerometer.  If  used,  it  would  be 
available  on  only  approximately  20  percent  of  the  fleet  and  would  need 
to  be  added  to  others.  At  this  time,  the  best  trade-off  for  normal 
acceleration  parameters  source  appears  to  be  the  counter  accelerometer. 

No.  7 .  Yaw  rate.  Yaw  rate  is  desired  because  there  is  no  direct 
source  of  sideslip  angle  (P  computed  from  inertial  signals  is  not  con¬ 
sidered  satisfactory).  Using  INF,  data  V^'  ,  V  '  ,  V^' ,  heading,  Euler 
angles  and  ground  track,  the  rates  of  all  three  body  axes  can  be  com¬ 
puted  but  would  be  unavailable  with  IMU  failure. 

Additional  installation  of  the  ASIP-type  rate  gyros  (SBU-3A)  could 
be  added  to  non-ASIP  aircraft.  Yaw  rate  signals  could  be  obtained  for 
most  blocks  of  A-lOs  from  the  SAS  computer  test  connector.  Recent 
aircraft  use  a  "vyro"*  in  the  SAS  yaw  system  and  the  output  is  adequate. 
For  this  study  this  latter  source  is  considered  for  use.  Loss  of  SAS, 
of  course,  causes  a  loss  of  rate  data. 

No.  31.  Roll  rate.  Roll  rate  can  be  derived  from  roll  attitude 
from  the  INS  with  probably  satisfactory  results  but  does  require  the 
preprocessing  of  the  signal,  or  the  recording  at  much  higher  rates 
resulting  in  some  loss  of  data  compression.  The  ASIP  type  roll  rate 
gyro  presently  used  in  20  percent  of  the  aircraft  could  also  be  added 
for  use  in  the  remaining  80  percent  at  somewhat  added  cost.  Roll  rate 
can  also  be  picked  off  of  a  test  connector  on  the  SAS  computer.  Recent 
aircraft  use  a  "vyro"  for  this  signal  which  has  adequate  rate  output  and 
high  reliability. 

*  "Vyro"  is  a  term  applied  to  a  vibrating  device  (similar  to  a  tuning 

fork)  which  provides  a  highly  reliable  substitute  for  a  rate  gyro. 
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If  the  "vyro"  or  SAS  computer  failed,  roll  rate  data  might  be  lost. 
However,  the  monitoring  of  SAS  status  discretes  and  loss  of  the  system 
may  provide  the  desired  data  anyway.  The  trade-off  involves  higher 
initial  and  life  cycle  cost  of  added  transducers  (with  improved  and 
lower  cost  of  processing  and  recording  of  data)  versus  the  savings  of  no 
added  transducer  (but  higher  recorder/processor  costs,  possibly  poorer 
data,  and  non-standardization).  The  difference  in  these  methods  will 
disappear  in  the  total  life  cycle  costs  and  cost  benefit  ratios,  so  the 
choice  is  based  on  other  than  economic  reasons. 

For  the  A- 10  installation,  the  SAS  "vyro"  is  initially  recommended 
as  the  most  economical  source. 

No.  32.  Pitch  rate.  The  same  comments  apply  as  for  roll  rate 
except  a  SAS  gyro  is  used  in  the  pitch  axis. 

No.  33.  Lateral  acceleration.  Comments  for  No^.  3  apply  except  no 
accelerometer  counter  exists,  so  the  added  ASIP  type  accelerometer  is 
recommended . 

Nos.  9,  10,  11,  12,  13,  and  14.  It  is  assumed  pots  will  be  added 
for  these  parameters.  LVDTs  exist  in  portions  of  the  SAS  system  but. 
provide  only  SAS/manual  differential  outputs.  LVDTs  usually  supply  a 
more  reliable  signal  than  pots  but  compared  to  pots  probably  would  add 
to  the  cost  and  installation  effort.  For  purposes  of  the  study,  the 
lower  cost  pot  installation  is  assumed. 

Discrete  Nos.  4,  5,  and  6.  Speed  brake  position  is  determined  frc'i 
a  position  transducer  in  early  blocks,  but  later  aircraft  and  modifica¬ 
tions  provide  only  limit  switch  signals.  To  determine  speed  Drake  at 
specific  positions,  the  voltage  (+28V  VDC  discrete)  at  SB  position 
switch  number  1  and  number  2  N.O.  and  N.C.  contacts  will  be  monitored 
(available  from  cable  connector  2762P12). 
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b.  F-15.  Table  9,  F-15  Investigators'  List  (reference  6),  is 
included  to  show  the  relative  importance  of  various  accident  investigations 
as  indicated  by  the  investigators  themselves  (questionnaire  tabulation). 

The  list  shows  50  parameters  of  which  only  36  were  requested  by  the 
investigators.  They  are  listed  in  12  groupings  of  descending  priority. 

As  in  the  A-10  list,  the  time  parameter  was  moved  to  the  head  of  the 
list  because  all  other  parameters  will  be  time  related  in  the  proposed 
recording  method.  The  percentage  that  a  parameter  was  requested  is 
shown  in  column  4  and  the  ranking  i;i  the  general  list  is  shown  in 
column  5. 

Table  10,  is  the  final  recommended  arrangement  of  parameters  to  be 
used  as  the  Configuration  I  representative  list  for  the  F-15.  The 
general  comments  in  the  prior  A-10  section  concerning  table  7  also  apply 
to  table  10.  The  F-15  presents  some  special  problems  of  its  own  (as 
does  the  A-10)  in  respect  to  control  surface  position  transducers.  The 
list  is  planned  on  the  assumption  that  the  Flight  Control  System  can  be 
used  as  a  source  of  roll,  pitch  and  yaw  rate.  It  is  also  assumed  that 
lateral  acceleration  and  normal  acceleration  are  obtained  from  the  FCS. 

An  alternate  source  for  the  normal  acceleration  is  from  the  ABK-17 
acceleration  counterset  on  all  aircraft.  There  is  no  direct  source  of 
longitudinal  acceleration.  This  parameter  can  generally  be  deduced  from 
airspeed,  attitude,  vertical  velocity,  etc.  Another  alternate  source  of 
aircraft  axis  linear  velocities  and  accelerations  is  from  the  Inertial 
system  outputs.  Roll  rate,  pitch  rate  and  yaw  rate  can  be  derived  from 
the  IMU  parameters  5,  7,  10,  14,  40,  and  50  shown  in  table  10. 

Parameters  5,  7,  51,  52,  and  53  can  be  used  to  derive  aircraft  axes 
linear  accelerations. 

Parameters  47  through  54  (except  48)  can  be  easily  eliminated  if 
pteviously  listed  parameters  are  recorded. 

Weapon  status  is  obtained  from  Digital  Words  NCI  394  through  403 
with  the  individual  bits  designated  CC175  through  CC199.  This  discrete 
data  coming  from  the  Bus  requires  no  extra  wiring,  as  do,  for  example, 

28  VDC  discretes,  and  hence  is  a  very  "cost  effective"  data  source.  To 
save  memory,  the  armament  data  could  be  recorded  once  at  gear-up  in  a 
fixed  location  in  memory  and  then  the  status  of  each  bit  changed  as  an 
event  occurs. 

Table  11  is  a  minimum  list  derived  from  table  10  for  the  Configura¬ 
tion  II  list. 
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Table  9.  F-15  Investigators'  List 


NO. 

PARAMETER 

RANKING 

GROUP 

REQUEST 

% 

GENERAL 

LIST 

RANKING 

1 

Time 

1 2 

0 

2 

2 

Master  caution 

1 

92 

7 

3 

Cal  airspeed 

2 

77 

1 

4 

Fuel  flow 

3 

69 

3 

5 

Baro.  alt. 

3 

69 

4 

6 

N  i 

4 

62 

9 

7 

Hyd.  pres. 

5 

54 

27 

8 

Elev.  position 

5 

54 

23 

9 

Stick  position 

6 

46 

17 

10 

CDP 

» 

46 

19 

1 1 

FTIT 

6 

46 

42 

12 

Pitch  attitude 

7 

38 

8 

13 

Norm,  load 

7 

38 

13 

14 

Aileron  position 

7 

38 

18 

15 

CAS /S AS  pitch 

7 

38 

35 

16 

n2 

7 

38 

5 

17 

Bank  attitude 

8 

31 

10 

18 

Rudder  position 

8 

31 

14 

19 

Throttle  position 

8 

31 

1 1 

20 

Rudder  ped .  position 

8 

31 

29 

21 

F.GT 

8 

31 

12 
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Table  9.  F-15  Investigators'  List  (Continued) 


GENERAL 

LIST 

RANKING 


26 


24 


15 


22 


16 


32 


46 


21 


49 


30 
28 

31 
41 

43 
25 

6 

57 

44 


Table  9.  F-15  Investigators'  List  (Continued) 


PARAMETER 

RANKING 

GROUP 

REQUEST 

X 

GENERAL 

LIST 

RANKING 

SB  pos. 

12 

0 

40 

Slat  pos. 

12 

0 

20 

Comm,  transmit 

12 

0 

45 

Paddle  switch 

12 

0 

50 

Anti-skid  fail 

12 

0 

68 

NAV  status 

12 

0 

- 

Inverter 

12 

0 

41 

Starter 

12 

0 

43 

Sides  lip 

12 

0 

38 

69 


Table  10.  F-15  Configuration  1  Parameter  List 
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Table  10.  F-15  Configuration  I  Parameter  List  (Continued) 


Table  10.  F-15  Configuration  I  Parameter  List  (Continued) 


Relative  Figures  of  Merit:  0  =  Lowest  Merit ;  5  =  Highest  Merit 


Table  10.  F-15  Configuration  I  Parameter  List  (Continued) 


Table  10.  F-15  Configuration  T  Parameter  List  (Continued) 


Table  10.  F-15  Configuration  I  Parameter  List  (Continued) 


Table  10.  F-15  Configuration  I  Parameter  List  (Continued) 
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Table  10.  F-15  Configuration  I  Parameter  List  (Continued) 


Sourrf  Code:  1.  MUX  BUS  4.  HARS  7.  HUD  10.  Added  sensors  Type  Code:  I.  Synchro  4  -  Digital  discrete  7.  AC  analog 

2  ADC/CADC  5.  1NS/1MU  8.  Acft.  wise  11.  KDA  2.  +28  VDC  discrete  Digital  data  8.  AC  discrete 

3.  FCS  6  Ct  9.  Engine  3.  0C  analog  f>  Lou  level  con-  9.  Frequency 

plenentary 
disc  rete 


Table  10.  F-15  Configuration  I  Parameter  List  (Continued) 


Sou rre  Code  1  MUX  BUS  4.  HANS  7.  H1JI)  10  Added  tensors  Typo  Code:  1  Synchro  4.  IliRilal  discrete  7-  AC  an.rluR 

l.  ADC/CAIJC  S.  1NS/1MU  B  A.  f l  .  raise  II  FUA  2-  *28  VDC  discrete  5.  Digital  data  8-  AC  discrete 

1.  res  6.  CC  9  Engine  3-  DC  .m;ilog  6.  Low  level  com-  9-  Frequrmy 

pi omen t  dry 
discrete 


Table  10.  F-15  Configuration  I  Parameter  List  (Continued) 


Table  11.  F-15  Configuration  II  Parameter  I’st 


NO. 

PARAMETER  (CONTINUOUS) 

NO.  ON 
CONFIG.  I 
LIST 

F-15 

ACC. LIST 
PRIORITY 

1 

Time 

1 

12 

2 

Cal  airspeed 

2 

2 

3 

Baro  alt 

3 

3 

B 

Norm  accel 

4 

7 

5 

Pitch  attitude 

5 

7 

6 

Bank  angle 

7 

8 

B 

Yaw  rate 

11 

12 

8 

AOA 

12 

9 

9 

True  heading 

10 

12 

10 

Vertical  vel 

14 

- 

11 

Fuel  flow  (L) 

16 

3 

12 

Tuel  flow  (R) 

17 

3 

13 

N2  (L) 

20 

7 

14 

n2  (R) 

21 

7 

15 

FTIT  (L) 

22 

6 

16 

FTIT  (R) 

23 

6 

17 

Hydraulic  pressure  (L) 

37 

5 

18 

Hydraulic  pressure  (R) 

38 

5 

Table  11.  F-15  Configuration  II  Parameter  List  (Continued) 


NO. 

PARAMETER  (CONTINUOUS) 

NO.  ON 
CONFIG.  I 
LIST 

F-15 

ACC. LIST 
PRIORITY 

19 

Roll  stick  force 

33 

6 

20 

Pitch  stick  force 

32 

6 

21 

Stabilator  position  (L) 

26 

5 

22 

Stabilator  position  (R) 

27 

5 

23 

Aileron  position  (L) 

28 

7 

24 

Aileron  position  (R) 

29 

7 

25 

Rudder  position  (L) 

30 

8 

26 

Rudder  position  (R) 

31 

8 

27 

Rudder  pedal  position 

34 

8 

28 

Roll  rate 

8 

- 

29 

Pitch  rate 

6 

- 

30 

Total  fuel  level 

15 

9 

31 

Nozzle  (L) 

24 

- 

32 

Nozzle  (R) 

25 

- 
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Table  11.  F-15  Configuration  II  Parameter  List  (Continued) 


NO. 

1 

PARAMETER  (DISCRETES) 

NO.  ON 
CONFIG.  I 

F-15 

ACC. LIST 

LIST 

PRIORITY 

1  Master  caution 


2  Fire  warn  lights 


3  ADC  status 


IMU  status 


5  CC  status 


6  I  CAS  yaw  caution  light 


CAS  pitch  caution  light 


8  CAS  roll  caution  light 


Autopilot  caution  light 


10  Oxygen  low  light 


Speed  brake  out/in 


2  Flaps  down 


13  Fuel  low  warning  light 


14  Rt  gen  out 


15  I  Lt  gen  out 


c.  F-16.  Table  12,  F-16  Investigators'  List  of  desired 
parameters  requested  by  accident  investigators  (reference  6),  is 
included  to  show  the  relative  importance  of  various  accident  investi¬ 
gations  as  indicated  by  the  investigators  themselves  (questionnaire 
tabulation).  The  list  shows  51  parameters  of  which  only  25  were  rated 
by  the  investigators.  They  are  listed  in  six  groups  of  descending 
priority.  The  "Time"  parameter  was  again  moved  to  the  head  of  the  list 
since  all  other  parameter  data  will  be  time  related.  Note  that  in 
itself,  time  of  events  does  not  appear  to  be  important  to  the  investi¬ 
gators.  Engine  data  appears  to  dominate  the  concern  of  the  investi¬ 
gators  in  F-16  mishaps.  This  is  probably  because  of  the  early  engine- 
related  problems  and  its  being  single-engined.  Also,  the  flight  control 
data  has  been  available  on  the  ejection  seat  recorder.  The  most  requested 
parameters  do  not  individually  correlate  well  with  the  composite  general 
list  sequence,  but  the  lower  priorities  on  the  two  lists  do,  on  the 
average,  compare.  Flight  control  data  is  in  the  lower  ranked  group. 

Table  13  is  the  final  recommended  arrangement  of  parameters  for  the 
F-16  Configuration  I  representative  list.  The  general  comments  of  the 
A-10  section  apply  to  table  13  also.  Of  special  interest,  the  F-16 
appears  to  have  the  most  useful  parameters  for  accident  investigation 
available  on  the  MUX  bus.  This  makes  for  relative  low  cost  and  simpli¬ 
fied  data  acquisition.  The  F-16  list  is  presented  with  the  aircraft 
dynamic  data  shown  taken  from  the  FCS  or  the  MUX  bus  with  most  MUX  data 
from  the  IMU  or  FCC.  As  presently  on  the  list,  the  pitch,  roll,  and  yaw 
rates  are  obtained  from  the  FCS.  Alternatively,  they  can  be  computed 
from  the  IMU  data  using  alternate  parameter  numbers  36  through  41  (as 
discussed  in  earlier  paragraphs).  Lowest  cost  for  recorder  installation 
would  require  some  IMU  or  FCC  software  changes  to  provide  the  body  axes 
dynamics  data  directly  onto  the  bus,  or  alternatively,  the  data  could  be 
computed  in  the  recorder  preprocessor,  or  at  post-playback  on  the  ground. 
The  most  straightforward  way  is  to  use  the  FCS  sensors  where  possible. 
Total  systems  cost  will  not  vary  greatly,  and  either  method  has  its 
merits . 

Of  special  interest  is  the  parameter  No.  30,  which  provides  fault 
and  status  readouts  of  most  systems  on  the  aircraft  (except  the  FCS  and 
engine).  The  data  appears  on  the  bus  cnly  after  a  fault  is  enunciated, 
and  the  pilot  acknowledges.  The  words  would  only  be  recorded  as  faults 
occur  and  the  pilot  acknowledges.  This  is  an  economical  source  of  much 
status  and  fault  data  (reprogramming  to  place  the  data  on  the  bus, 
addressed  to  the  recorder,  would  remove  the  pilot  from  the  loop). 

Table  14  lists  the  minimum  parameters  for  the  F-16  Configuration  II 
recorder.  Twenty-eight  continuous  type  parameters  are  listed.  Eighteen 
discretes  are  listed.  More  discretes  can  be  easily  added  in  respect  to 
signal  processing  and  memory  capacity.  Discretes  do,  however,  rapidly 
add  up  additional  wire  runs  unless  obtained  in  digital  form  from  the  MUX 
bus  or  from  the  ejection  seat  Manchester  buses. 
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Table  12.  F-16  Investigators'  List 


NO. 

PARAMETER 

RANKING 

GROUP 

REQUEST 

% 

GENERAL 

LIST 

RANKING 

1 

Time 

5 

0 

2 

2 

n2 

1 

80 

5 

3 

Fuel  flow 

1 

80 

3 

4 

Throttle  position 

2 

60 

11 

5 

Ni 

2 

60 

9 

6 

EGT 

2 

60 

12 

7 

Total  fuel 

2 

60 

1.5 

8 

Cal.  airspeed 

3 

40 

1 

9 

Pitch  attitude 

3 

40 

8 

10 

Yaw  rate 

3 

40 

6 

B 

Norm  accele cation 

3 

40 

13 

B 

Fuel  per  tank 

3 

40 

22 

13 

Roll  CAS/SAS 

3 

40 

16 

14 

Baro  altitude 

4 

20 

4 

15 

Mach  no. 

4 

20 

30 

16 

Bank  attitude 

4 

20 

10 

17 

Heading 

4 

20 

25 

18 

CDP 

4 

20 

19 

19 

Yaw  CAS/SAS 

4 

20 

21 

20 

Roll  rate 

4 

20 

36 

21 

Pitch  rate 

4 

20 

33 

Table  12.  F-16  Investigators'  List  (Continued) 


NO. 

PARAMETER 

RANKING 

GROUP 

REQUEST 

% 

GENERAL 

LIST 

RANKING 

22 

Oil  pressure 

4 

20 

28 

23 

A/B  position 

4 

20 

32 

24 

Radar  altitude 

4 

20 

31 

25 

Fire  light 

4 

20 

26 

26 

Sideslip  (p) 

4 

20 

38 

27 

AOA  (or) 

5 

G 

24 

28 

Stick  position 

5 

0 

17 

29 

Rudder  ped.  position 

5 

0 

29 

30 

Elev.  position 

5 

0 

23 

31 

Aileron  position 

5 

0 

18 

32 

Rudder  position 

5 

0 

14 

33 

CADC 

5 

0 

46 

34 

CAS/SAS  pitch 

5 

0 

35 

35 

CAS/SAS  roll 

5 

0 

16 

36 

CAS/SAS  yaw 

5 

0 

21 

37 

Gear  position 

5 

0 

57 

38 

Flap  position 

5 

0 

44 

39 

S/B  position 

5 

0 

40 

40 

Slat  position 

5 

0 

20 

41 

Comm,  transmit 

5 

0 

45 

8 


Table  12.  F-16  Investigators'  List  (Continued) 


NO. 

parameter 

RANKING 

GROUP 

REQUEST 

% 

GENERAL 

LIST 

RANKING 

42 

oat 

5 

0 

49 

43 

Anti-skid  fail 

5 

0 

68 

44 

Nav.  status 

5 

0 

- 

45 

Hyd.  pres. 

5 

0 

27 

46 

Util.  hyd.  pres. 

5 

0 

39 

47 

Gen. 

5 

0 

41 

48 

Inverter 

5 

0 

41 

49 

Master  cont. 

5 

0 

7 

50 

F.PU 

5 

0 

43 

51 

Starter 

5 

o 

_ 

43 

Rrli(  ivp  Figures  of  Merit:  0  -  Lowest  Merit;  ri  -  Hjgfiest  Merit 


Table  13.  F-16  Configuration  I  Parameter  List  (Continued) 


Lowfil  Merit;  5  -  Hi  Kites  l 


Table  13.  F-16  Configuration  I  Parameter  List  (Continued) 
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hsurri  of  ftrril:  0  *  |.**vesi  Her  it,  S  -  Highest  Merit 


Table  14.  F-16  Corf iguration  II  Parameter  List 


NO. 

PARAMETER  (CONTINUOUS) 

NO.  ON 
CONFIG. I 

LIST 

F-16 

ACC. LI ST 
PRIORITY 

1 

Time 

1 

5 

2 

Cal  airspeed 

2 

3 

3 

Normal  load 

3 

3 

n 

Baro  altitude 

5 

4 

5 

Vert,  velocity 

6 

- 

6 

Pitch  attitude 

7 

3 

n 

Picch  rate 

8 

4 

8 

Bank  angle 

10 

4 

9 

Roll  rate 

11 

4 

10 

Heading 

4 

4 

11 

p  (sideslip) 

12 

4 

12 

a  (AO A) 

13 

5 

13 

Fuel  flow 

14 

1 

14 

Fuel  quant. 

15 

2 

15 

n2 

16 

1 

16 

FTIT 

17 

2 

17 

Hyd.  pres.  A 

22 

5 

18 

Hyd.  pres.  B 

23 

5 

19 

Rudder  position 

24 

5 

20 

Flaperon  position  R 
- - -  ■  ■  , 

25 

5 
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Table  14.  F-16  Configuration  II  Parameter  List  (Continued) 


NO. 

PARAMETER  (CONTINUOUS) 

NO.  ON 

CONFIG. I 

LIST 

F-16 

ACC. LIST 
PRIORITY 

21 

Flaperon  position  L 

26 

5 

22 

Stabilator  R 

27 

5 

23 

Stabilator  L 

28 

5 

24 

Longitudinal  stick  force 

31 

5 

25 

Lateral  stick  force 

32 

5 

26 

Rudder  ped.  force 

33 

5 

27 

Oil  pressure 

21 

4 

28 

Yaw  rate 

9 

3 
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Table  14.  F-16  Configuration  II  Parameter  List  (Continued) 


NO. 

PARAMETER  (DISCRETES) 

NO.  ON 
CONFIG.! 
LIST 

F-16 

ACC. LIST 
PRIORITY 

D 

Master  caution 

2 

5 

2 

Fire  light 

1 

4 

3 

FCS  caution 

3 

5 

n 

FCS  dual  fail 

4 

5 

5 

Horizontal  tail  servo  arm  R  or  L 

5 

5 

6 

Flaperon  servo  arm  R  or  L 

6 

5 

n 

Rudder  servo  arm 

7 

5 

8 

Elec,  system  warn  light 

8 

5 

9 

Throttle  position  (above/below  A/B) 

9 

2 

10 

L.E.F.  caution  lite 

10 

5 

11 

Fwd.  fuel  low 

11 

5 

12 

Aft.  fuel  lew 

12 

5 

13 

BUC  lite 

16 

5 

14 

Oxy.  low 

15 

5 

15 

Speed  brake  open/close 

17 

5 

16 

Canopy  lock 

20 

5 

17 

Gear  up 

25 

5 

18 

Weight  on  wheels 

26 

5 

3.1.2  Aircraft  installation  investigation 


3. 1.2.1  Objective  -  LSI's  overall  objective  for  the  installation 
phase  of  the  CSFDR  study  was  to  provide  a  generalized  CSFDE  system 
installation  concept  which  can  be  applied  to  the  A-10,  F-15y  and  F-16 
aircraft  and  to  other  attack,  fighter,  or  trainer  (A/F/T)  aircraft. 

The  primary  CSFDR  system  configuration  recommended  by  LSI  consists  of 
two  units.  One  unit,  the  Data  Processing  Unit  (DPU) ,  which  does  not 
possess  crash-survivable  properties,  provides  the  data  conversion,  data 
processing  and  data  compression  functions.  The  DPU  interfaces  with 
existing  aircraft  systems  and  flight  controls  to  obtain  required  data. 
The  second  unit  is  a  Crash-Survivable  Memory  Unit  (CSMU) ,  possessing 
crash-survivable  properties  located  in  a  remote  area  of  the  aircraft  and 
connected  to  the  DPU  by  means  of  an  electrical  cable.  In  determining 
the  location  of  the  DPU  and  the  CSMU,  the  following  goals  and  require¬ 
ments  were  considered: 

•  Adequate  space  for  the  unit,  the  mounting  bracketry,  and 
attaching  electrical  cables. 

•  Survivability  for  the  Crash-Survivable  Memory  Unit. 

•  Proximity  of  all  units  of  the  CSFDR  system 

•  Pr  ximity  of  the  CSFDR  system  to  the  data  sources. 

•  Accessibility  of  the  individual  units  for  ease  of  main¬ 
tenance  and  data  extraction. 

•  Adequate  strength  of  the  surrounding  aircraft  structure 
to  support  and  hold  the  .dded  units  with  respect  to  the 
individual  aircraft's  mission  environment. 

•  Minimization  of  the  CSFDR  system  impact  on  the  aircraft's 
weight  and  balance  properties. 

3. 1.2.2  Installation  trade-off  study  -  The  initial  step  in  deter¬ 
mining  a  generalized  CSFDR  system  installation  concept  was  to  perform  an 
installation  trade-off  study  comparing  various  installation  concepts.  A 
generalized  representative  aircraft  was  assumed  for  the  purpose  of  this 
study  in  lieu  of  ^  specific  aircraft  in  the  Air  Force  inventory.  The 
aircraft  size  and  configuration  was  based  on  the  existing  inventory  of 
USAF  aircraft  in  the  attack,  fighter,  and  trainer  categories  (A-10,  F-A, 
F-5,  F-15,  F-16,  F- 111,  and  T-38).  Of  these  aircraft,  the  average  size 
appeared  to  be  that  of  the  F-A  or  slightly  smaller.  Consequently,  the 
hypothetical  aircraft  used  in  this  study  was  assumed  to  have  the  dimen¬ 
sions  and  configurations  illustrated  in  figure  2. 
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AVIONICS  BAY  - 


ASSUMPTIONS 

1.  Aircraft  configured  as  above 

2.  CSFOR  Production  Run  of  500  Systems 

3.  Flight  Control  Position  Sensors: 


LOCATION  QUANTITY 


Leading  Edge  Flaps  2 
Trailing  Edge  Flaps  2 
Ailerons  2 
Stabllator  1 
Rudder  I 
Speed  Brakes  ? 


4.  MIL-C-38S99  Electrical  Connectors 

5.  MIL-W-22759  Electrical  Wire 

6.  All  CSFOR  units  are  hardmounted 

7.  Combination  of  MIL-STD-1553  Oata  Bus  and  Analog  Data  Signals 

8.  Aircraft  to  DPU  Interface  cable  consists  of  60  wires. 

9.  OPU  to  CSMU  cable  consists  of  14  wires. 

(  2000546  ) 


Figure  2.  Installation  Trade-off  Study  Hypothetical  Aircraft 
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A  further  assumption  was  made  that  flight  control  position  sensors 
would  be  required  as  a  part  of  the  CSFDR  system  installation.  This 
involves  mounting  the  sensors  at  the  flight  control  locations  and  routing 
signal  cables  from  the  sensors  to  the  CSIDR  system. 

The  purpose  of  the  study  was  to  obtain  representative  costs  for  the 
Group-A  Kit  and  representative  installation  times  in  man-hours  of  direct 
labor  to  install  the  Group-A  Kit.  Included  in  the  estimated  A-kit  cost 
were  the  bracketry  to  mount  the  flight  control  position  sensors,  the 
bracketry  to  mount  the  recording  system,  the  interconnecting  electrical 
cables,  and  all  associated  hardware.  The  cost  of  the  CSFDR  Group-B 
components  were  not  included.  The  A-kit  costs  reflected  recurring  costs 
only.  Developmental  costs  were  not  included.  The  A-kit  costs  were 
estimated  based  on  a  large  continuous  production  run  (200  units  minimum), 
thereby  minimizing  manufacturing  set-up  charges.  The  estimated  man¬ 
hours  for  each  of  the  installations  were  for  installing  and  checking  the 
entire  CSFDR  system,  data  processor,  memory,  and  flight  control  position 
sensors . 

Four  basic  installations  were  considered  during  this  study.  Each 
installation  was  estimated  assuming  that  some  of  the  required  data  was 
available  from  a  MIL-STD- 1553-type  data  bus  and  some  data  had  to  be 
obtained  directly  from  the  data  source. 

•  Installation  I:  DPU  and  CSMU  combined  as  a  single  unit 
and  located  in  the  aircraft  avionics  bay. 

•  Installation  II:  DPU  and  CSMU  combined  as  a  single  unit 
and  located  in  the  aircraft  tail  section. 

•  Installation  III:  DPU  located  in  the  aircraft  avionics 
bay  with  multiple  semi-hardened  memories  located  in  the 
tail,  wing  tips,  and  canopy. 

•  Installation  IV:  DPU  located  in  the  aircraft  avionics 
bay  and  the  CSMU  located  in  the  tail. 

The  costs  of  each  of  the  above  four  installations  were  estimated, 
compared  to  a  base  installation  (Installation  I),  and  subjectively 
analized  with  respect  to  the  above  stated  goals  (see  table  15). 

a.  Installation  I.  DPU  and  CSMU  combined  as  a  single  unit 
and  located  in  the  aircraft  avionics  bay. 

Group-A  Kit  cost  =  1.0  (normalized  to  1.0) 

Installation  time  =  1.0  (normalized  to  1.0) 
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Table  15.  Comparison  of  Four  Installations 


INSTALLATION 

GROUP-A  KIT 
COST 

INSTALLATION 

TIME 

I 

1.00 

1.00 

II 

1.14 

1.26 

III 

2.73 

3.28 

IV 

1.43 

1.58 

The  kit  cost  and  installation  time  for  this  installation  were  the 
lowest  of  the  four  considered.  These  values  were  used  as  a  base  for  the 
comparison  of  the  remaining  three  installations.  Thus,  the  kit  cost  and 
installation  time  for  Installation  I  are  normalized  to  one.  The  rela¬ 
tively  low  cost  of  the  A-kit  and  minimal  kit  installation  time  are 
attributable  to  the  proximity  of  the  CSFDR  system  to  the  various  data 
sources,  thereby  minimizing  the  length  of  the  interface  cable  between 
the  aircraft  and  the  DPU.  Also,  the  single  unit  location  in  the  avi¬ 
onics  bay  contributes  to  the  ease  of  installation  and  the  accessibility 
of  the  units  for  maintenance  and  data  extraction.  Locating  the  entire 
system  in  the  aircraft  avionics  bay  minimizes  the  adverse  impact  on  the 
aircraft's  weight  and  balance  properties  by  placing  the  CSFDR  units 
close  to  the  aircraft  center  of  gravity.  However,  a  review  of  Air  Force 
Class-A  mishap  data  (reference  6)  shows  that  the  avionics  bay  in  a 
typical  Class-A  mishap  does  not  exhibit  a  high  degree  of  survivability. 
The  mishap  data  shows  that  the  avionics  bay  experiences  the  most  severe 
environment  when  considering  both  structural  break-up  and  heat  damage. 
Therefore,  the  memory  module  would  be  exposed  to  an  extremely  hostile 
environment  when  compared  to  other  aircraft  locations. 

b.  Installation  II.  DPU  and  CSMU  combined  as  a  single  unit 
and  located  in  the  aircraft  tail  section. 


Group-A  Kit  cost 

1.14 

Installation  time 

1.26 

The  kit  cost  for  this  installation  as  for  Installation  I  is  rela¬ 
tively  low.  By  locating  the  CSFDR  system  in  the  tail,  the  survivability 
of  the  memory  unit  is  enhanced,  since  the  Air  Force  Class-A  mishap  data 
(reference  6)  shows  that  the  aircraft  extremities  (wing  tips  and  tail) 
experience  the  maximum  survivability  rate.  However,  with  a  CSFDR  system 
installed  in  the  aircraft  tail  section,  all  of  the  signals  must  be 
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transmitted  from  the  data  source  to  the  tail.  Assuming  a  typical  mix  of 
data  bus  and  source  data  wires,  an  aircraft  to  CSFDR  system  interface 
cable  would  consist  of  m>.  re  than  60  wires.  Since  most  of  the  data 
sources  are  located  in  the  cockpit  area  of  the  aircraft  the  relatively 
large  interface  cable  must  be  routed  from  the  cockpit  through  the 
fuselage  to  the  CSFDR  system  in  the  tail. 

In  today's  modern  A/F/T  aircraft  available  space  is  often  at  a 
premium,  and  in  aircraft  extremities  such  as  the  wing  tins  and  tail 
section  even  available  space  puts  severe  constraints  on  the  permissible 
form  factor  of  units  so  located.  Thus,  even  a  relatively  low  volume 
(200  cubic  inches)  CSFDR  system  would  necessitate  special  packaging  to 
conform  to  available  space  in  the  tail.  Such  special  packaging  would 
increase  the  cost  of  the  CSFDR  system  and  would  decrease  the  commonality 
of  CSFDR  systems  between  models  of  aircraft  (i.e.,  F-16  versus  F-15). 

The  tail  area  of  an  A/F/T  type  aircraft  generally  is  not  very  accessable 
and  has  limited  mounting  areas  for  electrical  equipment,  thereby  increas¬ 
ing  the  difficulty  of  installation.  Also,  the  decreased  accessibility 
limits  the  maintainability  of  the  system  and  increases  the  difficult'/  of 
data  extraction  from  the  system. 

Of  all  the  installations  considered,  this  installation  would  have 
the  maximum  adverse  impact  on  the  aircraft  weight  and  balance  since  the 
entire  CSFDR  system  would  be  located  far  from  the  aircraft's  center  of 
gravity  and  would  require  a  large  cable  to  be  routed  from  the  cockpit 
area  to  the  tail.  However,  even  at  the  maximum,  the  adverse  impact  is 
minimal  since  the  weight  of  the  CSFDR  system  is  approximately  twelve 
pounds  (not  including  Group-A  Kit).  With  the  Group-A  Kit  the  system 
weighs  approximately  25  pounds  for  this  installation. 

c.  Installation  III.  DPU  located  in  the  aircraft  avionics 
bay  with  multiple  semi-hardened  memories  located  in  the  tail,  wing  tips, 
and  canopy. 

Group-A  Kit  cost  =  2.73 
Installation  time  =  3.28 

This  installation  is  the  most  expensive  and  time  consuming  instal¬ 
lation  of  the  four  considered.  The  large  increase  in  kit  cost  and 
installation  time  results  from  installing  four  separate  memories  in 
different  extremities  of  the  aircraft  and  installing  the  electrical 
cabling  from  the  DPU  to  the  separate  memories.  However,  this  instal¬ 
lation  does  ino  >orate  the  two  positive  characteristics  of  the  previous 
installations  of  i  ating  the  memory  in  a  survivable  area  of  the  air¬ 
craft  and  of  locati  g  the  DPU  in  an  accessible  area  of  the  aircraft 
close  to  the  data  sources. 
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Although  this  installation  provides  for  two  primary  system  attri¬ 
butes,  survivability  and  accessibility,  it  does  so  at  great  expense. 

The  increased  cost  of  the  system  deployment  (kits  and  installation) 
would  make  the  CSFDP  system  non-cost-effective  for  retrofit  applications. 

d.  Installation  IV.  DPU  located  in  the  aircraft  avionics  bay 
and  the  CSMU  located  in  the  tail. 

C-roup-A  Kit  cost  =  1.43 
Installation  time  =  1.58 

Although  this  installation  costs  more  in  dollars  and  man-hours  than 
I  or  II,  it  incorporates  the  positive  features  of  all  three  previous 
installations.  The  memory  is  located  in  a  survivable  area  of  the  air¬ 
craft.  Since  the  memory  is  smaller  than  the  single  unit  CSFDR,  it  can 
be  located  in  more  vemote  areas  of  the  aircraft  than  the  single  unit, 
thereby  increasing  its  survivability.  The  DPU  is  located  in  the  avi¬ 
onics  bay  close  to  the  data  signal  sources.  Being  located  in  the  avi¬ 
onics  bay,  the  DPU  is  accessible  and  thus  easily  maintained. 

The  increase  in  the  Group-A  Kit  cost  is  attributable  to  the  extra 
installation  bracketry  and  time  for  the  CSMU  since  it  is  separate  from 
the  DPU.  However,  the  increase  in  cost  and  installation  time  is  offset 
by  the  attributes  cf  this  installation.  As  stated  above,  the  CSMU  is 
located  in  a  remote  area  of  the  aircraft  (tail)  and  thus  will  exhibit  a 
higher  rate  of  survivability  as  evidenced  from  the  Air  Foret  mishap  data 
(reference  6).  Since  the  CSMU  is  of  relatively  small  size  (42  cubic 
inches),  the  typically  limited  available  space  in  the  aircraft  extremities 
is  no  longer  a  problem  as  in  Installation  II  where  the  entire  CSFDR 
system  was  located  in  the  tail. 

By  locating  the  DPU  in  the  avionics  bay,  a  number  of  benefits  are 
realized.  Since  the  avionics  bay  is  proximate  to  a  majority  of  the 
data  sources,  the  aircraft-to-CSFDR  interface  cable  (60  wires)  is  held 
to  a  minimum  length.  Although  separating  the  CSMU  and  the  DPU  requires 
an  extra  interface  cable  over  the  single  unit  configurations,  this  cable 
only  consists  of  14  wires,  which  is  only  25  percent  of  the  weight  and 
volume  required  by  the  cable  for  Installation  II.  This  small  cable  is 
thus  easier  to  route  and  integrate  info  the  typically  small  A/F/T  air¬ 
frame.  The  DPU  in  the  avionics  bay  also  enhances  the  accessibility  of 
the  system  for  maintenance  and  for  data  extraction,  as  the  very  nature 
of  the  equipment  in  t.he  avionics  bay  requires  ease  of  access. 

Typ  ically,  an  aircraft  airframe  is  not  designed  to  accei t  the 
installation  of  larger  electronic  units  in  its  extremities  (tail  and 
wing  tips).  However,  there  is  no  great  design  obstacle  to  install  a 
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unit  such  as  the  CSMU,  which  has  a  relatively  light  weight  and  low 
volume,  in  the  tail  and  wing  tip  areas.  An  aircraft  avionics  bay  is 
designed  to  accept  the  type  and  size  unit  as  displayed  by  the  DPU.  This 
installation  takes  the  requirements  and  characteristics  of  the  CSFDR 
system  into  account  and  directly  applies  them  to  the  A/F/T  aircraft 
under  consideration  in  this  study. 

e.  Conclusions  from  general  study.  The  discussion  and  cost 
evaluation  of  the  four  installations  considered  above  show  that  although 
Installations  I  and  IT  aie  the  least  costJv  in  terms  of  dollars  and 
manhours,  they  have  disadvantages  in  the  areas  of  maintainability, 
survivability,  and  accessibility.  Installation  III,  while  overcoming 
the  disadvantages  of  Installations  I  and  II,  becomes  costly  in  the  areas 
of  kit  cost  and  installation  time.  Installation  IV  overcomes  both  the, 
shortfalls  of  Installations  I  and  II  and  trie  costliness  of  Installation  III. 

Installations  I,  III,  and  IV  also  contain  added  benefits.  The 
location  of  the  DPU  in  the  avionics  bay  provides  for  ease  of  addition  of 
optional  memory  devices  for  the  recording  of  Aircraft  Structural  Integrity 
Program  (ASIP)  data,  turbine  engine  health  data,  flight  control  monitoring 
data,  or  aircraft  incident  data.  None  of  these  functions  requires 
crash-survivable  hardware,  therefore,  the  memory  devices  can  be  located 
close  to  the  DPU  in  an  accessible  area  for  ease  of  data  extraction. 
Separating  the  DPU  and  the  CSMU  provides  for  maximum  adapatibility  to 
the  various  Air  Force  airframes  and  minimum  impact  to  the  basic  CSFDR 
system  design,  thereby  resulting  in  a  CSFDR  system  that  is  standardized 
to  the  maximum  extent  possible.  The  separate  units  of  the  CSFDR  system 
are  also  adaptable  to  airframes  used  within  the  other  services  of  the 
DOD  as  well,  thus  contributing  to  interservice  standardization  in  addi¬ 
tion  to  intraservice  standardization.  Adopting  a  design  whereby  the 
CSMU  is  located  in  a  survivable  extremity  of  the  aircraft,  and  the  DPU  is 
located  close  to  the  data  sources  will  provide  a  CSFDR  system  that  is 
survivable,  maintainable,  flexible,  and  standardized  for  various  models 
of  aircraft. 

3. 1.2.3  General  installation  concept 

a.  Crash-Survivabie  Memory  Unit  (CSMU).  The  CSMU  is  located 
in  either  the  tail  section  or  a  wing  tip  of  the  aircraft.  Air  Force 
Class-A  mishap  data,  and  other  data  from  the  NTSB  and  Navy,  indicate 
that  these  are  the  two  areas  of  the  aircraft  that  enjoy  the  highest 
degree  of  survivability  in  a  destructive  mishap.  The  ejection  seat  end 
canopy  also  enjoy  a  high  degree  of  survivability.  However,  these  two 
locations  were  discarded  because  their  survivability  is  directly  related 
to  the  ejection  rate.  The  ejection  rate  for  the  three  subject  aircraft 
is  Al.l  to  80  percent  and  the  survivability  goal  of  the  CSMU  is  AO  to 
100  percent,  if  ejection  is  not  accomplished,  the  CSMU  would  remain  in 
the  cockpit  which  does  not  enjoy  a  high  degree  of  survivability  in  a 
destructive  mishap.  Attaching  the  CSMU  to  the  canopy  or  ejection  seat 
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would  probably  require  the  recertification  of  both  mechanisms  for  each 
model  of  aircraft.  Such  a  process  would  unnecessarily  increase  the 
developmental  cost  and  schedule  of  the  CSFDR  system  and  present  a  very 
complex  design  and  test  program,  which  may  turn  out  unfavorably.  Also, 
3.4.1  of  the  RFP  required  the  CSMU  to  be  retained  in  the  aircraft  until 
post-crash  recovery  which  would  not  be  possible  if  attached  to  the 
canopy  or  ejection  seat. 

The  CSMU  is  designed  to  be  attached  to  the  aircraft  structure  with 
standard  threaded  fasteners.  Depending  upon  the  application  aircraft, 
the  CSMU  may  be  mounted  directly  to  existing  aircraft  structure  o;  may 
be  mounted  to  bracketry  designed  specifically  for  the  installation  of 
the  CSMU.  Materials  used  in  manufacturing  will  be  approved  materials 
listed  in  MIL-HDBK-5C  and  mounting  hardware  will  be  selected  from  MS, 

NAS,  and  AN  specifications. 

b.  Data  Processing  Unit  (DPU).  The  DPU  is  located  close  to 

the  cockpit,  as  the  cockpit  area  is  the  major  source  of  the  data  signals 

required  for  the  CSFDR  system.  For  ease  of  maintenance  and  data  extrac¬ 

tion,  a  typical  installation  for  the  DPU  implies  a  location  in  an  existing 
avionics  bay.  The  access  panel  to  the  bay  employs  quick-release  latches 
or  easily  removable  fasteners  for  minimal  access  time.  Within  the  bay 

the  DPU  is  located  so  as  to  require  minimal  or  no  equipment  removal  to 
facilitate  DPU  removal  or  data  extraction  from  the  CSFDR  system. 

The  DPU  is  retained  in  the  avionics  bay  attached  to  the  aircraft 
structure  by  -,eans  of  two  MS14108  self-locking  electronic  equipment 
fasteners  or  the  equivalent.  These  fasteners  are  attached  directly  to 

the  existing  equipment  racks  in  the  bay  or  to  bracketry  added  to  facil¬ 

itate  the  installation  of  the  DPU.  The  MS14108  fasteners  apply  a  down¬ 
ward  and  rearward  force  to  the  DPU,  holding  the  front  of  the  unit  in 
place  and  forcing  the  rear  portion  of  the  DPU  into  a  retaining  device. 

The  installation  of  the  DPU  is  such  that  vibration  isolators  may  be 
added  if  the  operating  environment  in  the  avionics  bay  is  sufficiently 
severe  to  warrant  the  isolators.  However,  the  DPU  is  designed  to  be 
hardmounted  to  the  aircraft  airframe,  and  the  necessity  of  added  vibra¬ 
tion  isolation  is  highly  unlikely.  The  installation  of  the  DPU  in  the 
avionics  bay  is  of  sufficient  strength  to  comply  with  the  flight  load 
criteria  for  the  various  models  of  aircraft.  Special  crash  protection 
above  the  normal  design  goal  of  standards  MIL-A-008860A  (USAF)  and 
MIL-A-008865A  (USAF)  is  not  warranted  since  the  function  of  the  DPU  is 
completed  upon  catastrophic  impact  with  the  ground. 

c.  F.le'-trical  interfac.'.  The  DPU  and  the  CSMU  are  intercon¬ 
nected  by  means  of  an  electrical  cable.  This  cable  consists  of  six 
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twisted  pairs  of  conductors  for  data  transmission  and  one  shielded 
twisted  pair  used  to  supply  power  to  the  CSMU  for  a  total  of  fourteen 
conductors .  The  grounded  shield  around  the  power  conductors  provides 
EMI  protection  between  the  power  line  and  data  transmission  lines.  The 
shield  also  protects  the  data  conductors  from  being  shorted  to  the  power 
conductors  in  the  event  of  aircraft  structure  penetrating  the  cable  or 
in  the  event  an  aircraft  fire  begins  to  melt  the  cable.  Fire  and  heat 
protection  is  also  accomplished  through  the  use  of  MIL-W-25038  or  equiva¬ 
lent  high-temperature  and  fire-resistant  aircraft  electrical  wire. 

Further  fire  and  heat  protection,  as  well  as  cable  penetration  protec¬ 
tion,  is  furnished  as  a  side  benefit  by  the  application  of  dual  layers 
of  EMI  shielding  around  the  exterior  of  the  cable.  Connectors  used  on 
this  cable  are  of  an  approved  military  series. 

The  second  electrical  cable  used  in  the  CSFDR  system  is  the  air- 
craft-to-DPU  interface  cable.  This  cable  is  larger  than  the  previous 
cable  since  it  must  tie  in  to  all  of  the  CSFDR  data  sources.  Depending 
on  the  CSFDR  configuration  (I,  II,  or  III)  and  th-_  aircraft  model,  the 
aircraf t-to-DPU  interface  cable  consists  of  45  to  95  wires.  The  cable 
has  braided  sleeving  for  compactness  and  is  multi-branched  to  reach  all 
cf  the  various  data  sources.  The  wire  and  connectors  in  this  cable 
comply  with  approved  military  specifications  for  use  in  aircraft.  This 
cable  has  not  been  given  the  fire  and  heat  protection  of  the  previous 
cable  since  it  is  not  located  near  potential  high-heat  areas,  such  as 
engines  and  fuel  cells.  The  cable  complies  with  the  environmental 
specifications  of  the  area  in  which  it  is  located. 

The  aircraft-to-DPU  interface  cable  obtains  a  variety  of  signals 
from  a  number  of  data  sources  The  cable  wires  interface  with  the 
signals  by  splicing  into  existing  aircraft  wires  or  by  picking  up  unused 
pins  in  existing  electrical  connectors.  Assurance  will  be  made  during 
such  interconnections  that  compatible  interfaces  exist  for  a  properly 
integrated  system  and  that  disturbed  systems  are  not  adversely  affected. 
These  connections  are  terminated  using  military-approved  methods  and  MS, 
NAS,  AN  or  mil-spec  hardware.  Some  of  the  subject  aircraft  are  equipped 
with  data  bus  communicators.  The  aircraft-to-DPU  interface  cable  contains 
conductors  that  will  be  coupled  to  the  data  bus  lines  to  extract  data 
desired  for  storage  in  the  CSMU. 

Cables  used  to  interconnect  the  DPU  with  optional  memory  devices 
are  of  construction  similar  to  the  DPU-to-CSMU  cable.  Wire  and  connec¬ 
tors  comply  with  approved  military  series  specifications.  The  cable  is 
shielded  and  enclosed  in  braided  sleeving. 

Electrical  cable  construction,  termination,  and  routing  comply  with 
MIL-W-5088  "Aerospace  Vehicle  Wiring",  technical  order  1-1A-14  and 
applicable  aircraft  specifications.  Where  possible,  electrical  cable 
routing  is  accomplished  along  existing  electrical  cable  runs.  Long 
cables  are  designed  with  midpoint  disconnects  when  required  by  aircraft 
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construction,  such  as  going  through  pressure  bulkheads  or  through  a 
structure  that  divides  from  the  aircraft.  Appendix  C  is  a  list  of 
federal  specifications,  military  standards  and  technical  orders  utilized 
by  LSI  in  the  design,  fabrication,  and  installation  of  electrical  Group-A 
Kit  hardware  on  military  aircraft. 

d.  Position  sensors.  Included  in  the  desired  data  param¬ 
eters  to  be  recorded  by  the  CSFDR  system  are  the  positions  of  various 
movable  elements  of  the  aircraft  such  as  flight  controls,  throttles,  and 
control  sticks  The  F-16  has  a  majority  of  these  sensors  installed 
prior  to  CSFDR  while  the  F-15  has  a  limited  number  of  existing  sensors 
and  the  A-10  has  very  few. 

Sensing  the  position  of  a  movable  element  of  the  aircraft  can  be 
accomplished  by  mounting  a  precision  potentiometer  proximate  to  the 
flight  control  surface,  throttle,  or  control  stick,  and  mechanically 
linking  the  movable  element  of  the  potentiometer  to  the  aircraft's 
movable  element.  As  the  control  surface,  throttle,  or  control  stick  is 
moved,  the  potentiometer  varies  the  voltage  of  the  electrical  signal 
transmitted  to  the  DPU.  The  various  voltage  levels  are  then  stored  in 
memory  and  can  be  translated  to  position  data  upon  extraction  from  the 
CSFDR  memory. 

The  wiring  interconnecting  the  potentiometers  and  the  DPU  is  designed, 
fabricated,  and  installed  in  accordance  with  the  specifications  used  for 
the  CSFDR  system  cables,  as  described  in  previous  paragraphs.  Mechanical 
mounting  hardware,  brackets,  and  connecting  linkages  are  designed, 
fabricated  and  installed  in  accordance  with  applicable  military  spec¬ 
ifications  and  military-approved  hardware. 

The  precision  potentiometers  used  in  the  sensor  installation  are 
relatively  1-  ..  in  cost  and  meet  the  requirements  of  MIL-R-39023  and 
MIL-E-5272.  The  potentiometers  are  constructed  of  an  aluminum  case  with 
stainless  steel  ball  bearings  and  shaft.  The  resistive  element  is 
conductive  plastic  on  a  ceramic  chip  and  the  wiper  is  a  precious-metal 
alloy.  Typical  characteristics  are  as  follows: 


Resistance  value 

10K  ohms 

Linearity 

-  .25% 

Rotational  angle 

350  degrees 

Temperature  range 

-  -65°C  to  +  125°C 

Vibration 

-  15  g 

Shock 

-  50  g 

Rotational  load  life 

25,000,000  revolutions 

3. 1.2. 4  A-10  installation  -  The  proposed  CSFDR  system  installa¬ 

tions  for  the  A-10  aircraft  make  optimum  use  of  available  space  and 
existing  electrical  cable  routes  in  the  aircraft.  CSFDR  unit  locations 
are  essentially  identical  for  Configurations  I,  II,  and  III  and  have 
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been  coordinated  with  the  airframe  manufacturer.  The  general  CSFDR 
installation  is  shown  in  figure  3. 

The  DPU  is  located  in  door  F-10  on  the  right-hand  side  of  the 
aircraft  below  the  cockpit.  For  Configurations  I  and  II,  the  DPU 
occupies  the  upper  forward  position  in  the  bay  (see  figure  4). 

The  Configuration  III  CSFDR  system  replaced  the  existing  Signal 
Data  Multiplexer  Converter  and  the  Signal  Data  Recorder  on  ASIP  desig¬ 
nated  aircraft  with  the  CSFDR  DPU  and  the  optional  memory  units  for 
aircraft  structural  integrity  program,  turbine  engine  health,  and  flight 
control  monitoring.  The  Configuration  III  DPU  and  memory  units  are 
installed  in  the  locations  vacated  by  the  existing  multiplexer  and 
recorder  (see  figure  5).  The  DPU  location  in  door  F10  is  close  to  the 
major  data  sources  insuring  that  the  aircraft-to-DPU  interface  cable  is 
maintained  at  minimum  length  and,  therefore,  has  minimum  impact  on  the 
aircraft  weight  and  balance.  This  cable  is  connected  to  the  DPU  in  door 
F10  and  branches  out  to  interface  with  all  of  the  required  data  sources 
for  the  CSFDR  system.  The  cable  branches  are  routed  along  existing 
cables  to  minimize  the  impact  on  the  aircraft  configuration. 

The  interconnecting  cable  between  the  DPU  and  the  CSMU  is  routed 
along  existing  electrical  cable  runs  in  the  right-hand  side  of  the 
aircraft  fuselage  to  fuselage  station  536.  A  cable  disconnect  is  pro¬ 
vided  at  this  point  to  correspond  to  the  existing  aircraft  configura¬ 
tion.  The  cable  continue?  from  fuselage  station  536  through  the  aft 
fuselage  and  terminates  at  the  CSMU.  The  CSMU  is  located  in  the  upper 
tail  cone  area  of  the  aircraft  immediately  forward  of  the  forward  hori¬ 
zontal  stabilizer  support  bulkhead  (door  F57)  at.  fuselage  station  680 
(see  figure  6).  This  location  was  chosen  to  provide  the  CSMU  with  a 
maximum  snrvivable  environment  based  on  the  Air  Force  Class-A  mishap 
data  end  on  the  airframe  manufacturer's  evaluation  of  A-10  mishaps. 

CSFDR  Configurations  I,  II,  and  III  require  the  measurement  of  the 
position  of  various  movable  aircraft  components.  The  components  requir¬ 
ing  such  measurements  are  left  and  right  rudder,  left  and  right  elevator, 
left  and  right  aileron,  throttles,  rudder  pedals,  and  pilot's  control 
stick.  This  requirement  necessitates  the  addition  of  eleven  potentiom¬ 
eters  to  provide  the  measurements.  The  potentiometers  are  mounted  as 
described  in  the  preceding  paragraphs.  Wiring  for  the  potentiometers  is 
routed  along  existing  electrical  cable  runs  and  is  integrated  with  added 
CSFOR  cables  wherever  possible. 

3. 1.2.5.  F-15  installation  -  The  CSFDR  installations  for  the  F-15 

aircraft  utilize  existing  available  space  and  equipment  to  provide  an 
optimum  CSFDR  system  installation.  The  CSFDR  unit  locations  for  Config¬ 
urations  I  and  II  are  identical.  The  locations  of  the  DPU  and  additional 
memory  units  change  for  Configuration  III.  The  CSFDR  unit  locations  for 
all  configurations  were  coordinated  with  the  airframe  manufacturer.  The 
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Figure  3.  A-10  General  CSFDR  System  Installation 
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Figure  6.  A-10  CSMU  Location 


general  CSFDR  installation  for  Configurations  I  and  II  is  shown  in 
figure  7  and  for  Configuration  III  is  shewn  in  figure  8. 

For  Configurations  I  and  II,  the  DPU  is  located  in  the  left-hand 
side  of  the  environmental  control  systems'  bay  in  door  15  (see  figure  9). 
Discussions  with  the  airframe  manufacturer  revealed  that  impending  ECPs 
for  the  F-15  have  depleted  all  available  space  in  the  forward  equipment 
bays.  Mounting  cf  the  DPU  is  accomplished  by  added  structural  brackets 
as  described  in  preceding  paragraphs.  The  DPU  is  located  in  a  desirable 
position  to  interface  with  the  required  CSFDR  data  sources.  The  aircraft- 
to-DPU  interface  cable  is  connected  to  the  DPU  in  the  ECS  bay  and  branches 
to  both  the  left  and  right  sides  of  the  forward  fuselage  along  existing 
electrical  cables  and  interfaces  with  the  various  data  sources. 

For  Configuration  III,  the  DPU  and  the  additional  memory  units  for 
aircraft  structural  integrity,  turbine  engine  health,  and  flight  control 
monitoring  are  located  in  door  155L  (see  figure  10).  These  units  replace 
the  existing  Signal  Data  Recorder.  The  DPU  and  memory  units  are  mounted 
on  added  structural  brackets.  The  aircraft-to-DPU  cable  interfaces  with 
the  data  sources  as  in  Configurations  I  and  II.  Door  15  is  fastened 
with  quad-lead  type  fasteners  for  quick  access. 

The  interconnecting  cable  between  the  DPU  and  the  CSMU  is  routed 
along  existing  cable  runs  in  the  aircraft.  For  Configuration  III,  the 
aircraft  to  DPU  cable  runs  forward  to  the  ECS  bay.  For  all  three  con¬ 
figurations  the  cable  is  then  routed  above  the  left-hand  engine  intake 
aft  to  the  trailing  edge  area  of  the  left  wing.  At  this  point  the  cable 
runs  outboard  into  the  drv  area  of  the  left  wing  to  door  143L.  The  CSMU 
is  located  in  door  143L  inboard  of  the  aileron  actuator  (see  figure  11). 
Air  Force  Class-A  mishap  data  showed  the  F-15  wing  tip  areas  to  exhibit 
the  maximum  survivability  along  with  the  vertical  stabilizer.  The  wing 
location  was  chosen  over  the  vertical  stabilizer  for  reasons  of  access¬ 
ibility,  maintainability,  and  ease  of  installation.  The  CSMU  position 
in  the  wing  and  the  DPU-to-CSMU  interconnecting  cable  routing  are  located 
in  areas  readily  accessible  by  removing  existing  panels.  A  tail  location 
for  the  CSMU  would  have  necessitated  the  addition  of  an  access  door  for 
the  CSMU,  thus  increasing  CSMU  installation  costs. 

Configurations  I,  II,  and  III  require  the  measurement  of  left  and 
right  stabilator,  left  and  right  aileron,  left  and  right  rudder,  throttle, 
rudder  pedal,  and  pilot's  control  stick  positions  during  flight.  The 
aircraft  has  existing  mechanisms  installed  to  measure  this  data  on  the 
left  and  right  aileron  and  the  left  rudder.  These  signals  are  interfaced 
with  the  CSFDR  system.  The  remaining  measurements  can  be  accomplished 
by  installing  eight  potentiometers  at  the  various  aircraft  component 
locations  and  interfacing  the  outputs  with  tiie  CSFDR  system.  The 
potentiometer  installations  are  achieved  as  described  in  the  preceding 
paragraphs.  Wiring  for  the  potentiometers  is  routed  along  existing 
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Figure  7.  F-15  CSFDR  System  Configurations  I  and  II 
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Figure  10,  DPU  Location  -  F-15  CSFDR  System  Configuration  III 
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electrical  cable  runs  and  is  integrated  with  CSFDR  system  cables  whenever 
poss ible . 

3. 1.2.6  F-16  installation  -  The  installations  for  the  F-16  aircraft 

utilize  existing  aircraft  space  and  existing  aircraft  installations  to 
provide  an  optimum  CSFDR  system  installation.  The  unit  locations  for 
Configurations  1,  II,  and  III  are  essentially  identical,  linit  locations 
for  the  three  configurations  were  coordinated  with  the  airframe  manu¬ 
facturer.  The  general  installation  for  the  three  configurations  is 
shown  in  figure  12. 

The  DPU  for  all  three  configurations  is  located  in  the  aft  equip¬ 
ment  bay  immediately  aft  of  the  cockpit  (see  figure  13).  Access  to  this 
bay  is  through  door  2101  on  the  left  side  of  the  aircraft  and  through 
door  2202  on  the  right  side  of  the  aircraft.  For  Configuration  III,  the 
DPu  and  the  memory  units  for  the  aircraft  structural  integrity  program, 
turbine  engine  health,  and  flight  control  monitoring  replace  the  existing 
Signal  Data  Multiplexer  Converter  and  the  Signal  Data  Recorder  on  desig¬ 
nated  aircraft.  The  aft  equipment  bay  location  for  the  DPU  provides 
easy  access  to  data  sources  and  easy  access  for  data  extraction.  Because 
oi  the  proximity  of  the  M61A  gun  muzzle  to  the  aft  equipment  bay,  the 
DPU  and  the  memory  units  may  require  vibration  isolation  due  to  the 
hostile  environment  created  during  gun  firings.  The  aircraft  to  DPU 
interface  cable  is  connected  to  the  DPU  in  the  aft  equipment  bay  and 
branches  out  along  existing  electrical  cable  runs  to  the  varir  s  data 
sources . 

The  DPU  to  CSMU  interconnecting  cable  is  routed  from  the  aft  equip¬ 
ment  bay  to  the  right  side  of  the  aircraft  through  the  right-hand  main 
landing  gear  wheel  well  to  the  right-hand  shelf  area  forward  of  the 
stabilator.  The  CSMU  is  installed  in  the  right-hand  shelf  forward  of 
the  chaff  dispenser  (see  figure  14).  This  location  for  the  CSMU  was 
chosen  based  on  the  Air  Force  Class-A  mishap  data,  limited  available 
space  in  the  airframe,  and  on  discussions  with  the  airframe  manufacturer. 
The  CSMU  is  located  in  the  general  plane  of  rotation  of  the  F103  engine 
turbine  section.  However,  because  of  the  limited  space  available  in  the 
aircraft  and  the  low  survivability  rate  of  other  locations,  this  area  is 
determined  to  be  the  optimum  location  for  the  CSMU.  As  an  added  precau¬ 
tion  against  turbine  failure,  additional  armor  plating  is  installed 
between  the  CSMU  and  the  aircraft  engine. 

3.1.3  Crash-surv ivabi 1 i ty  invest i gat i on  -  The  crash-survivability 
investigation  is  an  extremely  challenging  engineering  task.  The  inves¬ 
tigation  occasionally  required  judgemental  evaluation  and  the  prevailing 
belief  of  professionals  and  experts  in  lieu  of  hard  facts  and  rigorous 
calculations.  The  vciy  nature  of  severe  A/F/T  crashes  is  awesome. 
High-speed  impacts  result  in  total  destruction  of  the  aircraft  and  the 
variations  possible  are  unlimited.  No  two  accidents  are  identical  and 
on  single  crash  can  be  classified  as  genuinely  typical. 
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The  results  of  the  crash-survivability  investigation  will  be  criti¬ 
cal  to  the  success  of  the  CSFDR  program.  Unreasonably  severe  crash 
requirements  will  result  in  unjustified  equipment  cost.  Relaxed  require¬ 
ments  will  be  equally  disastrous,  resulting  in  poor  survivability  per¬ 
formance  . 

The  optimum  CSFDR  design  will  not  survive  100%  of  the  A/F/T  crashes. 
The  original  goal  was  90%  survivability.  However,  as  the  study  program 
progressed,  it  soon  became  apparent  that  greater  than  96%  survivability 
was  possible  using  state-of-the-art  digital  memory  technology.  The 
proposed  concepts  are  optimal  designs,  which  have  only  recently  become 
possible  due  to  memory  technological  advances. 

This  portion  of  the  study  program  involved  six  related  tasks.  Each 
task  will  be  described  in  sequence  as  follows: 

•  A/F/T  mishap  data.  The  assembled  military  A/F/T  mishap 
data  will  be  summarized  in  the  text,  while  an  appendix 
will  present  supportive  data  and  conclusions. 

•  Comparison  of  crash  test  requirements.  The  crash  test 
requirements  of  TSO  C51A  will  be  compared  with  A/F/T 
aircraft  mishaps  to  determine  if  the  requirements  should 
be  altered. 

•  Recommended  test  conditions.  Appropriate  test  conditions, 
which  simulate  crash  conditions  postulated  for  the  CSFDR, 
will  be  recommended. 

•  Crash  protection  evaluation.  Physiral/mechanical/thermal 
control  techniques  are  compared  and  evaluated,  for  the 
protection  of  the  memory  module,  from  the  effects  of 
A/F/T  crashes. 

•  Recommended  CSFDR  packaging  approach.  The  recommended 
packaging  approach  will  be  illustrated,  along  with  external 
interfaces . 

•  Crash-survivability  prediction.  A  prediction  of  the 
survivability  of  the  crash-protected  memory  (CPM)  data 
will  be  made  based  on  USAF  mishap  history. 

3. 1.3.1  A/F/T  mishap  data  -  The  research  of  available  military 
A/F/T  mishap  data  was  undertaken  early  in  the  study  program.  The  results 
were  crucial  to  early  program  decisions  and  they  are  very  evident  in  the 
recommended  solutions.  Not  only  did  this  research  provide  a  basis  for 
argument  and  deduction,  but  it  also  provided  a  wealth  of  sources  possess¬ 
ing  years  of  experience  in  the  fields  of  accident  investigation,  aircraft 
safety,  and  crash  environments. 
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Three  sources  of  mishap  data  were  pursued  in  order  that  an  educated 
comparison  could  be  made.  The  first  was  a  literature  search  of  available 
reports  pertaining  to  crash-survivability  data.  Many  study  reports  have 
been  written,  but  all  of  them  were  for  aircraft  crashes  in  which  the 
occupants  could  have  survived.  The  wealth  of  analyses  and  data  ends  at 
crash  severity  levels  which  would  be  fatal  to  the  occupants.  Available 
data  is  for  shallow  impact  angles  (<15°)  and  low  velocities  (< 1 60  fps). 

The  second  source  pursued  was  the  opinion  of  aerospace  experts, 
including  consultants,  Air  Force,  Navy,  NTSB,  NASA,  and  airframe  prime 
contractor  personnel.  Again,  for  the  most  part,  current  thinking  and 
experience  was  limited  to  low  speeds  and  shallow  impact  angles.  Several 
experts  expressed  their  opinion  as  to  the  structural  limits  of  A/F/T 
structures,  but  tew  would  hazard  a  guess  as  to  the  resultant  impact 
g  levels.  The  most  useful  result  of  this  inquiry  was  uncovering  the 
equations  used  by  missile  engineers  to  predict  g  levels,  depth  of 
penetration,  and  the  deceleration  time  period  for  missile  and  projectile 
ground  impacts.  These  equations,  the  underlying  assumptions,  ?nd  the 
deduced  results,  will  be  shown  and  utilized  throughout  the  crash-surviv¬ 
ability  text. 

The  third  source  of  mishap  data  pursued  was  the  wealth  of  data  on 
file  at  the  Air  Force  Inspection  and  Safety  Center,  Norton  Air  Force 
Base.  Other  data  bank  sources  were  pursued  including  the  Army,  Navy, 
and  NTSB,  but  none  of  them  materialized  into  such  useful,  pertinent  data 
as  that  of  the  AFISC.  Norton  personnel  were  extremely  cooperative  and 
helpful  in  aiding  this  pursuit.  An  accident/mishap  data  questionnaire 
was  transmitted  to  them.  They  compiled  the  data  for  35  Class-A  accidents 
involving  A-10,  F-15,  and  F-16  aircraft  between  January  1977  and  August 
1980.  The  responses  to  the  questionnaire  are  shown  in  reference  6.  A 
summary  of  the  mechanical  and  fire  damage  for  the  cockpit,  avionics  bay, 
wing  tips,  vertical  tail,  and  tail  cone  is  presented  in  tables  16  and  17. 
Upon  reviewing  this  data,  an  obvious  conclusion  is  that  the  the  wing 
tips,  tail  cone,  and  vertical  tail  are  significantly  more  survivable 
regions  of  the  aircraft  than  are  the  cockpit  and  avionics  bay,  in  a 
post-mishap  environment. 

In  addition,  the  Air  Force  computer  printout  of  over  500  recent 
Class-A  and  -B  accident  reports  were  requested  and  two  separate  trips 
were  made  to  Norton  Air  Force  Base.  On  the  second  trip,  a  film  of  an 
A-10  crash  was  requested  and  researched  for  possible  post-crash  data. 

The  film  was  analyzed  with  respect  to  1)  the  chain  of  events  tran¬ 
spiring,  2)  the  nature  of  the  ensuing  fireball,  and  3)  the  impact 
deceleration  phenomena. 
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Table  16.  Mechanical  and  Fire  Damage  for  35  A-10,  F-15,  and  F-16 

Class-A  Accidents 


Mechanical  Damage 


A-10  (17  accidents) 
Cockpit 
Avionics  Bay 
Wing  Tips 
Tail  Cone 
Vertical  Tail 

F-15  (13  accidents) 
Cockpit 
Avionics  Bay 
Wing  Tips 
Tail  Cone 
Vertical  Tail 


F-16  (5  accidents) 
Cockpit 
Avionics  Bay 
Wing  Tips 
Tail  Cone 
Vertical  Tail 


1 

2 

3 

ra 

29% 

47% 

12% 

47% 

24% 

6% 

- 

9% 

26% 

18% 

35% 

12% 

18% 

24% 

12% 

12% 

18% 

18% 

29% 

77% 

8% 

8% 

77% 

8% 

- 

8% 

23% 

8% 

12% 

34% 

15% 

8% 

8% 

15% 

15% 

Fire  Damage 


20%  60%  20% 
20%  60%  20% 


30%  70% 

40%  60% 


Table  16.  Mechanical  and  Tire  Damage  for  35  A-10,  F-15,  and  F-16 

Class-A  Accidents  (Continued) 


Relative  Ranking 


Mechanical  Damage 


2  3 


Fire  Damage 


Summary  A-10,  F-15 

and  F-16 

(35  accidents) 

Cockpit 

Avionics  Bay 

Wing  Tips 

Tail  Cone 

Vertical  Tail 


n  9% 

3%  15% 

0%  14% 

7%  43% 
2%  17% 


3%  9%  28%  14%  46% 

6%  9%  23%  20%  43% 

4%  19%  34%  43% 

9%  20%  26%  46% 

9%  23%  32%  37% 


Col. 

Mechanical  damage 

Col. 

Fire  damage 

1 

Total  (many  small  pieces, 

1 

Total  (major  pud- 

not  recognizable) 

dling) 

2 

Major  (many  medium  pieces, 

2 

Major  (burnthrough 

some  recognizable) 

and  some  puddling) 

3 

Significant  (some  large 

3 

Minor  (paint  burn/ 

pieces  recognizable) 

sooting) 

4 

Minor  (relatively  intact) 

4 

None 

- 

Unknown 

- 

Unknown 

Table  17.  Mechanical  and  Fire  Damage  Ranking  of 
Possible  CSFDR  System  Installation  Locations 


MECHANICAL 

Aircraft 

Section 

DAMAGE 

Damage1 

Known 

Total 

Major 

Signi¬ 

ficant 

Minor 

Average3 

Damage 

Rank¬ 

ing 

Mechanical 
Surviva¬ 
bility  of 
Location 

1 

2 

3 

4 

Cockpit 

32 

16 

12 

1 

3 

1.72 

m 

poor 

Avionics  Bay 

30 

19 

8 

2 

1 

1.50 

poor 

Wing  Tips 

602 

9 

11 

12 

28 

2.98 

good 

Tail  Cone 

20 

4 

3 

7 

6 

2.75 

9 

good 

Vertical  Tail 

29 

4 

5 

5 

15 

3.07 

i 

good 

FIRE  DAMAGE 

Aircraft  Damage1 

Total 

Major 

Signi¬ 

ficant 

Minor 

Average3 

Rank- 

Fire  Sur¬ 
vivability 
of  Loca- 

Section 

Known 

1 

2 

3 

4 

Damage 

ing 

tion 

Cockpit 

19 

1 

3 

10 

5 

3.00 

4 

poor 

Avionics  Bay 

20 

2 

3 

8 

7 

3.00 

4 

poor 

Wing  Tips 

402 

0 

3 

13 

24 

3.53 

1 

good 

Tail  Cone 

19 

0 

3 

7 

9 

3.32 

3 

good 

Vertical  Tail 

z2 

0 

3 

8 

11 

3.36 

2 

good 

1  Extent  of  damage  not  known  for  all  35  of  the  analyzed  A-10,  F-15,  and  F-16 
accident  reports. 

2  Left  and  right  wing  data  for  each  mishap  were  combined. 

i . .  ,  r  a  ..  ,.  l6(l)+12(2)+l(3)+3(4)  _  , 

Mathematical  average  of  damage  severity  (i.e., - rv — —— - -  l./z). 
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The  assembled  data  from  actual  accident  reports  is  shown  in  appen¬ 
dix  D.  Tables  D-l  and  D-2  of  appendix  D  show  results  similar  to  those 
presented  in  table  16.  It  should  be  noted  that  the  impact  velocity 
ranged  from  0  to  550  fps  and  that  the  impact  angles  ranged  from  0° 
to  70°.  Shown  in  table:  D-3  is  the  range  of  dollar  value  and  the  crew 
ejection  ratios  for  '  of  the  500  accidents.  Twelve  types  of  A/F/T 
aircraft  were  included  as  a  typical  cross  section,  while  six  other  types 
weLe  omitted. 

This  substantial  accident  data  base  was  utilized  throughout  the 
crash-survivability  investigation.  The  significant  differences  between 
the  degree  of  damage  to  the  forward  portions  of  the  fuselage,  versus  the 
tail  cone  and  extremities,  was  paramount  in  the  system  design  concepts 
and  installation  decisions.  The  latter  locations  are  much  less  vul¬ 
nerable  to  mechanical  damage  and  less  vulnerable  to  the  resulting  fire 
damage.  Among  the  extremities,  the  crash  environment  in  the  wing  tips 
is  preferable,  with  the  vertical  tail  a  very  close  second,  and  the  tail 
cone  a  not  too  distant  third. 

3. 1.3. 2  Comparison  of  crash  test  requirements  -  The  five  crash 
test  requirements  of  TSO  C51A  are  impact,  penetration  resistance,  static 
crush,  fire  protection,  and  water  protection.  The  requirements  are 
compared  with  A/F/T  aircraft  mishaps  in  order  to  determine  if  the  require¬ 
ments  should  be  altered. 

a.  Impact  requirement  (TSO  C51A).  TSO  C51A  impact  shock 
requirement  is  1000  g,  half  sine  wave,  applied  to  each  orthogonal  axis, 
and  having  a  time  duration  of  at  least  5  milliseconds.  This  requirement 
is  inadequate  for  the  CSFDR  program.  We  recommend  1)  changing  the  pulse 
shape,  2)  increasing  the  peak  g  level,  3)  adding  a  second  lower  level, 
longer  duration  shock  requirement,  and  in  general,  4)  removing  the 
ambiguities  and  inconsistencies. 

The  impact  shock  pulse  should  be  changed  from  a  half  sine  wave  to  a 
terminal  peak  sawtooth  shock.  Half  sine  wave  shock  pulses  are  typically 
a  result  of  elastic  collisions  in  which  one  or  both  of  the  colliding 
objects  do  not  exceed  their  elastic  limit.  That  is  definitely  not  the 
case  during  post-crash  breakup  of  A/F/T  aircraft.  Widespread  plastic 
deformations  and  structural  failures  are  predominant. 

An  added  benefit  cf  terminal  peak  sawtooth  pulses  is  that  it  is  a 
more  inclusive  measure  of  the  high  frequency,  short  duration  shock  wor¬ 
thiness  of  the  design.  The  higher  frequences  receive  greater  excita¬ 
tion  energy,  without  over  exciting  the  lower  primary  frequency  range. 

This  point  has  been  argued  and  proven  repeatedly  over  the  years  by  test 
engineers  throughout  the  aerospace  industry. 
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The  peak  level  of  1000  g  should  be  increased.  Crash-protected 
memory  only  capable  of  surviving  levels  of  1000  gs  will  demonstrate 
unsatisfactory  crash-survival  rates.  In  the  fifteen  accident  reports 
summarized  in  appendix  D,  four  of  the  impact  angles  were  between  16°  and 
62°  and  the  aircraft  velocities  were  145  to  325  kias  (245  to  550  fps). 
With  these  high  impact  angles  and  high  speeds,  the  TSO  C51A  shock  level 
will  not  be  adequate,  as  will  be  shown  by  the  following  analyses. 

In  missile  and  projectile  ground  impact  design,  the  Army  uses  the 
following  equation  to  calculate  g  levels,  depth  of  penetration,  and  time 
period  of  penetration.  The  equation  assumes  a  rigid  missile  structure, 
which  is  not  totally  applicable  for  A/F/T  impacts.  However,  the  equa¬ 
tion  does  establish  an  upper  limit.  The  equation  is  a  modified  flow 
resistance  equation  (note  the  drag  coefficient  and  the  velocity  squared 
term),  which  has  been  substantiated  with  actual  missile  testing.  The 
projectile  impact  equation  is  as  shown  below  with  the  parameters  defined 


in  terms  of  A/F/T  impacts. 

MZ 

= 

where 

M 

= 

mass  of  aircraft  (lbm.) 

Z 

= 

deceleration  (g) 

CD 

= 

drag  coefficient  =  2  (unitless) 

P 

= 

density  of  impact  media  (lbm. /cubic 
feet) 

A 

= 

projected  fuselage  cross-sectional  area 
(square  feet) 

8c 

= 

gravitational  constant,  32.174  (lbm. -ft 
lbf .-sec. 2) 

Z 

= 

velocity  at  impact  (ft. /sec.) 

a 

= 

bearing  strength  of  media,  a  =  14,400 
for  sand  (lbf. /square  feet) 

The  equation  can  be  solved  for  Z  and  then  integrated  twice,  in 
closed  form,  in  order  to  solve  for  depth  of  penetration  Z  and  time 
period  of  penetration  T. 
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z 

T 


where 

0 

Note,  because  this  equation  is  basically  a  flow  resistance  equa¬ 
tion,  it  assumes  the  fuselage  nose  fully  penetrates  the  surface  of  the 
media  and  the  direction  of  Z  is  parallel  and  directly  opposite  the 
velocity  vector.  The  angle  of  impact  is  independent  except  that  it  must 
be  high  enough  (>15°  to  20°),  such  that  the  nose  fully  penetrates  the 
surface  of  the  media,  and  does  not  simply  receive  a  glancing  or  deflec¬ 
ted  impact.  The  density  of  the  impact  media,  which  will  be  used,  Is 
120  lbm. /cubic  feet  (note,  dry  sand  is  100  lbm. /cubic  >eet,  common  black 
soil  or  wet  sand  is  125  lbm. /cubic  feet).  The  aircraft  area  density 
term  (M/A)  appears  in  all  three  equations,  and  in  order  to  simplify  the 
calculations,  it  was  set  equal  to  .0032  lbm. /square  feet  for  typical 
commercial  aircraft  (Boeing  747,  440/160,000  =  .00275,  small  commuters 
45/12,500  =  .0036)  and  .0015  lbm. /square  feet  for  military  A/F/T  (A10, 
52/35,000  =  .00149).  It  should  also  be  noted  that  the  shock  pulse 
shape,  as  predicted  by  the  equations,  will  resemble  an  initial  peak 
sawtooth  pulse. 


A 
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A 


CDP 


In 


Cos  0 


,  (ft.) 


- 1  p  V 

tan  [(^ — — )  '  V]  ,  (radians) 


Using  the  projectile  impact  equations,  table  18  was  generated 
showing  g  level,  period,  and  depth  of  penetration,  for  both  commercial 
aircraft  and  military  A/F/Ts  at  various  impact  speeds.  As  shown,  1000-g 
shock  qualified  hardware,  will  be  shock  worthy  of  impact  velocities  up 
to  418  fps.  (250  knots).  A  1700-g  shock  requirement  will  expand  the 
range  of  coverage  to  550  fps.  (326  knots).  In  just  the  15  A-10  and  F-16 
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mishaps  cited  in  appendix  D,  three  of  the  fifteen  (20%)  had  impact 
velocities  greater  than  or  equal  to  250  knots.  Those  three  accident 
reports  listed  indicated  airspeeds  of  250,  273,  and  325  knots.  There¬ 
fore  it  is  recommended  that  the  peak  g  level  of  the  impact  shock  require¬ 
ment  be  increased  to  1700  gs. 

The  time  period  and  depth  of  penetration  has  no  real  relevance  to 
the  impact  shock  requirement  and  its  pulse  duration  because  of  the 
structural  limitations  of  the  airframe.  Depth  nf  penetration  is  only 
listed  for  comparison  sake.  It  should  be  emphasized  that  the  above 
calculations  are  for  wet  sand  or  common  black  soil.  In  desert  sand, 
depth  of  penetration  would  be  nearly  70%  deeper.  In  addition,  the 
impact  velocity  corresponding  to  1700  gs  is  775  fps.  (470  knots,  Mach  .7) 
and  870-g  level  at  550  fps.  (326  knots,  Mach  .5).  Each  calculation 
assumes  a  homogeneous  impact  media,  without  the  presence  of  boulders, 
vegetation,  and  other  dense  foreign  objects. 

The  structural  limitations  of  an  A/F/T  will  insure  that  the  full 
g  levels  are  not  sustained  throughout  the  entire  period  of  ground  pene¬ 
tration.  The  more  significant  time  period  is  the  time  it  takes  the 
shock  stress  wave  to  travel  the  length  of  the  aircraft  and  return.7 
Shock  waves  travel  at  the  speed  of  sound  in  a  stressed  member.  It  will 
take  6.5,  7.65,  and  5.4  milliseconds  for  an  impact  shock  wave  to  travel 
twice  the  length  of  an  all  aluminum  A-10,  F-15,  and  F-I6,  respectively. 
These  time  period  calculations  assume  that  the  aircraft  structure  can  be 
treated  as  a  single  composite  aluminum  beam  and  the  structure  can  dynami¬ 
cally  support  the  initial  build-up  of  stresses,  until  the  peak  stress 
levels  are  attained.  The  stress  wave  theory  states  that  the  maximum 
stresses  will  be  attained  5-8  milliseconds  after  initial  nose  impact  for 
a  42'  to  67'  long  aluminum  aircraft.  This  theory  supports  the  argument 
that  the  shock  impulse  time  duration  should  be  specified  as  .005  to  .008 
seconds . 

In  order  to  be  more  inclusive,  a  family  of  shock  pulse  (g  level, 
time  duration)  requirements  should  be  imposed.  Regardless  of  the  g  level 
and  time  duration  specified,  there  will  always  be  an  A/F/T  crash  which 
will  either  subject  the  CSFDR  system  to  high  g  levels  for  a  shorter 
duration  or  lower  g  levels  for  a  longer  duration.  Impact  shock  testing 
to  an  entire  family  of  impulse  shocks  is  not  recommended  and  is  totally 
unrealistic.  However,  a  second  lower  g  level,  longer  duration  shock  is 
recommended,  and  monitoring  and  recording  the  resultant  high  g  level, 
short  duration  impulse,  occurring  during  the  penetration  testing  is 
recommended.  Monitoring  the  resultant  shock  characteristics  will  pro¬ 
vide  a  comparative  measure  of  penetration  test  severity.  It  will  also 
prove  that  an  added  high  g  level,  short  duration  shock  requirement  will 
be  somewhat  redundant. 


7Raymond  J.  Roark  and  Warren  C.  Young:  "Formulas  for  Stress  and 
Strain",  Fifth  Edition,  McGraw  Hill,  1975,  pp.  572-3. 


A  basic  principle  of  shock  pulse  phenomena  is  that  the  shock  pulse 
adequately  excites  all  frequencies  possessing  a  period  which  is  less 
that  twice  the  t^me  duration  of  the  input  pulse.  Therefore,  with  an 
impact  shock  pulse  of  .005  to  .008  seconds  duration,  the  frequencies 
above  62.5  to  100  Hz  will  receive  significant  excitation  energy  from  the 
1700-g  shock  pulse.  However,  the  low  g  level,  low  frequency  and  the 
high  g  level,  high  frequency  modes  of  impulse  damage  will  not  be  sub¬ 
jected  to  sufficient  shock  test  levels. 

If  a  family  of  impact  shock  pulses  were  to  be  considered,  the 
following  three  would  be  included: 

•  Low  g  level,  long  duration  200  gs  15.  msec 

•  Primary  impact  shock  requirement  1,700  gs  5.-8.  msec 

•  High  g  level,  short  duration  4,000-10,000  gs  <1.  msec 

The  first  would  lower  the  range  of  significantly  excited  frequen¬ 
cies  down  to  33  Hz  at  200  gs  and  the  third  would  increase  it  to  500  Hz 
at  4,000  to  10, GOO  gs .  As  stated  above,  each  of  these  can  be  encoun¬ 
tered  during  a  post-crash  environment.  An  almost  infinite  number  of 
combinations  of  aircraft  speeds  and  density  of  impact  media  are  possible. 
Additionally,  in  severe  impacts  where  the  aircraft  literally  shatters 
into  many  small  pieces,  the  resulting  debris  collisions  enter  an  expanded 
realm  of  possibilities.  The  CSMU  could  remain  attached  to  a  large 
portion  of  the  aircraft,  a  moderate  size  piece  of  structure  and  skin,  or 
it  could  even  become  a  totally  detached  projectile.  The  low  g  level, 
long  duration  shock  could  result  if  the  portion  of  structure  were  large 
and  its  impact  velocity  low.  The  high  g  level,  short  duration  shock 
would  be  favored  with  a  totally  detached  CSMU  traveling  at  high  speeds. 

The  200-g,  15-millisecond  duration  shock  requirement  is  recommended 
as  an  addition  to  the  impact  shock  test  requirement.  It  is  selected 
because  it  is  the  realistic  upper  limit  of  standard  aerospace  shock  test 
equipment.  This  requirement  can  be  imposed  with  only  a  minor  test  cost 
impact  for  the  CSFDR  program.  However,  this  requirement,  or  one  similar, 
is  essential  to  the  program.  Water-soaked  wicks,  resilient  mounting 
material,  flexible  insulation,  water  filled  bags  and  other  relatively 
resilient  material  will  be  more  susceptible  to  longer  duration  impulse 
shock.  Hardware  could  easily  pass  the  primary  impart  shock  test,  and 
yet  fail  miserably  in  a  long  duration,  low  g  level  test.  This  additional 
requirement  is  necessary  in  order  to  detect  and  correct  a  possible 
deficiency  in  the  design  worthiness  of  the  crash-protected  hardware. 


The  4,000-  to  10,000-g,  less-than-l-millisecond  shock  level,  is  not 
recommended.  If  imposed,  it  would  require  very  sophisticated  shock  test 
equipment.  Possibly  a  test  employing  explosive  charges  would  be  needed 
to  achieve  this  high  g  levels  and  short  duration.  Secondly,  the  pene¬ 
tration  test  could  result  in  a  shock  pulse  of  similar  magnitude  and 
duration.  A  crude  calculation  for  the  penetration  test  indicates  8,000  gs 
for  a  .5-millisecond  impact  pulse.  The  penetration  test  impact  pulse 
will  be  quite  unrepeatable  and  uncontrollable,  in  both  amplitude  and 
duration.  However,  an  accelerometer  can  be  mounted  to  the  CSMU  which 
will  be  subjected  to  the  crash-survivability  testing.  By  doing  so,  the 
resultant  impact  shock  magnitude  and  duration  can  be  monitored  and 
reported. 

A  final  comment  on  the  impact  shock  test  requirement  of  TSO  C51A  is 
that,  in  general,  the  Technical  Standard  Order  is  much  too  ambiguous  and 
inconsistant.  For  example,  the  time  duration  is  specifier  as  "at  least 
five  milliseconds"  which  would  permit  a  30-millisecond  time  duration  at 
the  supplier's  discretion.  The  CSFDR  impact  shock  requirement  will  need 
to  be  specified  in  a  much  more  conclusive  manner.  M1L-STD-810C,  figures 
516.2  and  516.2-2  could  be  iollowed,  in  which  the  nominal  value  and 
tolerances  are  precisely  specified  for  the  pulse  shape,  its  peak,  and 
its  duration.  Each  of  the  TSO  C51A  requirements  suffer  from  similar 
ambiguities.  They  will  need  upgrading  to  military  and  Air  Force  standards. 

b.  Penetration  resistance  requirement  (.TSO  C51A).  TSO  C51A 
penetration  resistance  requirement  is  specified  as  subjecting  the  memory 
package  to  "an  impact  force  equal  to  a  500-pound  steel  bar  which  is 
dropped  from  a  height  of  10  feet  to  strike  each  side  of  the  enclosure  in 
the  most  critical  plane".  Additionally,  the  point  of  contact  shall  be 
no  greater  than  .05  square  inches  (.25"  diameter).  Improvements  in  the 
penetration  test  can  be  made  by  1)  specifying  the  length,  shape,  and 
material  of  the  impact  point,  2)  better  specifying  of  the  test  setup 
which  is  to  be  utilized,  and  3)  reducing  the  mass  of  the  steel  bar  from 
500  to  100  pounds. 

The  mounting  location  of  the  CSMU  is  critical  to  the  degree  of 
penetration  resistance  which  is  necessary  for  adequate  survivability  in 
an  A/F/T  mishap  environment.  The  forward  portions  of  the  fuselage  and 
areas  in  the  rotational  plane  of  the  engine  turbine  blades,  will  be  the 
most  severe  locations.  The  turbine  blades  are  thrown  through  the  side 
of  the  aircraft  following  a  severe  mishap.  Those  mounting  locations  in 
their  rotational  path  should  be  avoided  if  possible.  In  addition,  the 
forward  portions  of  the  fuselage  are  frequently  penetrated  by  structural 
members  located  in  the  aft  sections  of  the  aircraft.  The  wings,  tail 
cone,  and  vertical  tail  will  be  less  severe  penetration  environments. 

The  most  glaring  inadequacy  of  the  TSO  requirement  is  that  the 
impact  point  is  not  specified.  The  length,  shape,  and  minimum  material 
properties  of  th<=  impact  point  should  be  specified.  The  recommendation 
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here  is  to  simulate  a  .25-inch  diameter,  high-strength  steel  bolt.  Its 
length  should  be  long  enough  to  reach  the  memory  media,  if  the  armor 
plate  and  insulation  are  fully  penetrated.  In  the  case  of  our  CSMU,  we 
recommend  a  blunt  .25-mch  diameter,  high-strength  steel  cylinder,  with 
the  ends  chamfered  .030-. 050  inches  (at  =45°),  and  with  the  cylinder 
protruding  1.1  inch  out  of  the  end  structure  of  the  drop  weight.  In 
addition,  a  compressive  yield  strength  of  the  steel  cylinder  should  be 
200  ksi  minimum  and  the  cylinder  should  be  securely  attached  to  the  drop 
weight.  If  second  sourcing  of  recorders  is  anticipated,  a  standardized 
cylindrical  point  should  be  specified  at  this  initial  stage  of  the 
program.  It  should,  therefore,  have  an  increased  length  in  order  to 
accommodate  a  somewhat  larger  memory  unit. 

Details  of  the  test  setup  to  be  utilized  should  be  specified.  The 
dimensions  of  the  drop  weight,  the  fixturing  and  guides  necessary  to 
insure  a  vertical  freefall  and  impact,  and  details  of  the  support  media 
for  the  test  article,  should  be  specified  and  standardized  as  much  as 
possible.  An  18-inch  base  of  fine  sand  in  which  the  test  article  is 
placed  with  the  impacted  surface  horizontal,  within  1°  in  each  axis  is 
recommended.  The  maximum  density  and  allowable  grain  size  of  the  sand 
should  be  specified.  The  drop  weight  should  be  guided  by  a  pair  of 
guide  rails,  one  on  each  side,  with  two  guides  (top  and  bottom)  attach¬ 
ing  the  drop  weight  to  each  guide  rail.  The  guides  can  be  loose  fitting 
eyebolts,  as  long  as  the  top  and  bottom  guides  are  separated  as  far  as 
is  practical  from  each  other  guaranteeing  a  vertical  impact  within  a  few 
degrees.  The  test  should  be  standardized  with  specified  dimensioning  of 
a  suitable  drop  weight. 

The  mass  of  the  500-pound  steel  bar,  as  specified  by  TS0  C5IA, 
should  be  reduced  significantly.  There  are  three  basic  reasons  why  this 
recommendation  is  proposed.  The  first  is  that  the  weight  can  be  reduced 
without  affecting  the  severity  of  the  test.  Secondly,  the  TSO  require¬ 
ment  is  overspecified  for  commercial  recorders  located  in  the  aft  sections 
of  the  aircraft.  Thirdly,  the  armor  thickness  necessary  is  determined 
by  this  test  requirement  and  a  tradeoff  between  mechanical  and  thermal 
survivability  is  made,  as  the  armor  thickness  is  increased.  With  all 
arguments  considered,  a  100-pound  drop  weight  is  recommended. 

The  mass  of  the  drop  weight  can  be  reduced  without  significantly 
lowering  the  severity  of  the  test.  If  the  CSMU  test  article  were  freely 
supported  (i.e.,  its  impact  resistance  provided  only  by  its  own  inertia), 
the  stresses  in  its  armor  would  be  completely  independent  of  the  impactor's 
mass.  Only  the  impact  area,  its  material  properties,  and  the  velocity 
of  the  impactor,  would  be  relevant  to  the  induced  stress  level.  If 
rigidly  mounted,  tne  maximum  stress  would  increase  proportionally  to 
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1+  CM+ - 667 ) ^ ,  where  p  is  the  ratio  of  the  mass  of  impactor  to  the  mass  of 
the  impacted  object  (reference  7). 

These  relationships  assume  solid  homogeneous  impact  materials. 

However,  they  are  quite  applicable  to  the  recorder  penetration  testing. 
Table  19  summarizes  the  stress  levels  versus  impactor  weight  for  the 
existing  commercial  recorders  and  the  proposed  CSMU.  It  should  be  noted 
that  even  the  proposed  change  to  a  100-lbm.  drop  weight  will  result  in 
higher  stress  levels  in  the  CSMU  armor,  than  the  stresses  in  the  armor 
of  existing  commercial  recorders  (weighing  20  lbm.),  if  both  units  are 
provided  with  the  same  degree  of  armor  protection.  This  argument  main¬ 
tains  that  the  relative  stress  severity  is  increased,  even  though  one 
fifth  of  the  drop  weight  mass  is  to  be  utilized. 

The  TSO  penetration  requirement  is  an  overspecification  for  the 
commercial  flight  data  recorders.  The  requirement  was  initially  made 
to  cover  the  option  of  locating  commercial  FDRs  in  the  forward  sections 
of  the  aircraft.  Since  the  policy  of  locating  the  FDRs  in  the  aft  sec¬ 
tions  of  the  aircraft  has  been  implemented,  penetration  damage  to  com¬ 
mercial  FDRs  has  been  minimal.  In  fact,  no  commercially  available 
flight  recorder  has  suffered  detrimental  penetration  damage  in  the  last 
ten  years.  With  this  in  mind,  even  the  100-lbm.  requirement  may  be  too 
severe.  In  comparing  the  commercial  to  military  mishaps,  the  higher 
velocities,  higher  impact  angles,  and  higher  structural  density  of  the 
A/F/T  aircraft  will  tend  to  increase  the  severity  of  the  penetration 
environment.  Conversely,  the  great  decrease  in  recorder  size  and  mass, 
the  literal  explosion  of  the  A/F/T  structure  upon  severe  impact,  and  the 
proposed  mounting  locations  for  the  CSMU,  will  all  tend  to  lessen  the 
chances  of  detrimental  penetration  damage. 

The  penetration  requirement  lor  the  CSFDR  system  will  determine  the 
armor  thickness  necessary  to  pass  the  crash-worthiness  qualification 
testing.  Not  only  does  the  armor  thickness  add  directly  to  the  size  and 
weight  of  the  CSMU,  but  additional  thickness  adds  to  the  quantity  of 
insulation  required  for  the  same  degree  of  thermal  protection.  As  will 
be  shown  in  the  thermal  performance  section  of  the  report,  the  maximum 
memory  chip  temperatures  will  be  reached  long  after  the  post-crash 
flames  are  extinguished.  The  thermal  justification  for  this  phenomenon 
is  that  the  armor  plating  scores  up  a  tremendous  amount  of  thermal 
energy  because  of  its  high  thermal  capacitance  and  high  relative  density. 
After  the  flame  is  extinguished,  the  thermal  energy  continues  to  be 
slowly  conducted  through  the  insulation,  as  well  as  being  convected  and 
radiated  back  to  the  ambient  environment.  For  the  recommended  design, 
following  a  15-minute  equivalent  i’.ame  test,  the  temperature  of  the 
memory  chips  will  be  139°C  when  the  flame  is  extinguished.  Some  19  minutes 
later  it  will  reach  its  maximum  temperature  of  253°C.  As  the  armor 
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Table  19.  Penetration  Test  Requirement  - 
Stress  Levels  vs.  Impactor  Weight 


Recorder  freely  supported 


°  tjE] 


Recorder  rigidly  supported  |  a  =  [-  E  (1  +  Vm+ - 667 ) ] 

3 

O  =  compressive  stress  in  impacted  member, 
(psi) 

V  =  velocity  of  impactor  at  time  of  impact, 
(ft/sec) 

a  =  speed  of  sound  in  impacted  member, 
(ft/sec) 

E  =  modulus  of  elasticity  for  impacted 
member,  (psi) 

p  =  mass  of  impactor/mass  of  impacted  member, 
(unitless) 


Commercial 
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1.0 
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2.8 
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14.39 

1.0 
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200. 

2.8 

71.4 

9.49 

1.0 

5.24 

100. 

2.8 

35.7 

7.03 

1.0 

4.02 

70. 

2.8 

25. 

6.07 

1.0 

3.53 

thickness  is  increased,  this  time  delay  will  lengthen  and  the  maximum 
temperature  will  rise  slightly.  Doubling  the  armour  thickness  will 
increase  the  memory  thermal  damage  potential  30  to  40%.  With  this  in 
mind,  it  is  definitely  not  in  the  best  interest  of  the  program  to  over 
specify  the  penetration  test.  An  adequate  test  level  should  be  arrived 
at,  but  too  severe  a  requirement  will  result  in  a  size,  cost,  weight, 
and  thermal  performance  penalty. 

It  should  also  be  noted  that  in  the  proposed  installation  for  the 
F-16,  the  CSMU  will  be  adjacent  to  the  engine  turbine  blades.  An  attempt 
was  made  to  avoid  this  installation  location,  but  it  met  with  little 
success.  In  order  to  shield  the  CSMU  from  turbine  blade  penetration 
damage,  the  recommendation  is  to  first  mount  an  armor  "guard  plate"  to 
the  aircraft  structure,  and  then  mount  the  CSMU  outboard  of  this  plate. 
This  added  precaution  should  offset  the  added  risk  of  mounting  the  CSMU 
in  the  rotational  plane  of  the  turbine  wheel  and  blades. 

c.  Static  crush  requirement  (ISO  C51A).  The  TSO  specifies  a 
continuous  force  of  5,000  lbf.  for  5  minutes,  applied  to  each  of  the 
three  main  orthogonal  axes,  but  not  simultaneously.  A  strong  argument 
can  be  made  for  reducing  this  requirement  from  5,000  to  2,000  lbf  ,  as 
well  as  a  strong  case  for  eliminating  it  entirely.  However,  it  presents 
absolutely  no  design  impact  if  included.  It  may  be  worth  maintaining 
the  requirement  in  the  event  that  a  structural  deficiency,  which  is 
further  weakened  by  the  dynamic  testing,  is  present  in  the  packaging 
design  or  workmanship. 

Since  the  engine,  tail,  wing,  and  main  fuselage  sections  of  an 
A/'F/T  are  much  lighter  than  a  large  commercial  jel  ,  a  strong  argument 
can  be  made  for  reducing  the  requirement  from  5,000  to  2,000  lbf.  In 
addition,  any  crash-protected  memory  enclosure,  which  can  withstand  both 
the  penetration  and  impact  test  levels  specified,  will  assuredly  pass 
the  static  crush  testing.  In  the  CSMU  design,  the  attached  circuit 
board,  dust  cover,  and  connector  will  be  destroyed  in  this  test.  How¬ 
ever,  the  memory  retention  will  be  unaffected  by  the  crushing  loads.  It 
is  recommended  that  the  level  of  the  test  be  reduced  to  2,000  lbf. 

d.  Fire  protection  requirement  (TSO  C51A).  TSO  C51A  speci¬ 
fies  a  15-  or  30-minute  test,  dependent  upon  the  mounting  location  of 
the  recorder,  in  which  50%  of  the  outside  surface  of  the  recorder  is 
exposed  to  flames  of  1100°C.  The  mishap  data  indicates  that  the  sever¬ 
ity  of  the  fire  protection  requirement  should  be  increased.  A  flame 
test  should  be  avoided  in  the  CSFDR  program  because  any  flame  test 
literally  defies  standardization  and  an  oven  test  will  be  recommended  as 
a  replacement.  Since  the  vast  majority  of  A/F/T  post-crash  fires  last 
less  than  5  minutes,  a  15-minute  oven  test  will  be  more  than  adequate. 
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As  shown  in  table  16,  total  (major  puddling)  and  major  (burnthrough 
and  some  puddling)  fire  damage  occur  at  a  substantial  rate.  Using  the 
summary  table,  listing  the  data  from  all  thirty-five  A-10,  F-15,  and 
F-16  accidents,  total  or  major  fire  damage  occurs  in  4  to  15%  of  the 
mishaps,  depending  upon  aircraft  location.  For  each  region  of  the 
aircraft  listed,  the  following  percentages  apply:  cockpit  12%,  avionics 
bay  15%,  wing  tips  4%,  tail  cone  9%,  and  vertical  tail  9%.  These  percent¬ 
ages  are  substantial  enough  that  the  fire  protection  requirement  must 
simulate  the  equivalent  of  at  least  major  fire  damage  in  which  burnthrough 
and  some  puddling  occur. 

The  melting  points  of  titanium  (1800°C)  and  steel  (1370°C)  are 
significantly  higher  than  that  of  aluminum  (660°C).  It  can  be  assumed 
that  the  puddling  and  burnthrough  phenomena  occur  totally  to  the  aircraft 
aluminum  members,  in  the  vast  majority  of  mishaps.  It  is  our  contention 
that  the  fire  protection  test  should  be  severe  enough  so  that  if  a  piece 
of  aluminum  were  subjected  to  the  test,  it  would  suffer  n.ajor  surface 
melting,  if  not  total  melt  down.  A  CSMU  design  capable  of  passing  such 
a  test  is  feasible  and  practical  at  a  reasonable  cost,  size,  and  weight. 

Any  design  not  capable  of  passing  such  a  requirement  will  suffer  detri¬ 
mental  fire  damage  in  4  to  15%  of  A/F/T  mishaps,  as  verified  by  mishap 
data.  A  design  capable  of  surpassing  the  proposed  requirement,  and  one 
which  will  be  mounted  in  the  wings  or  tail  section  of  A/F/T  aircraft, 
could  possibly  survive  more  than  99%  of  the  fire  damage  mishap  environments. 

In  order  to  evaluate  the  flame  test  requirement  of  TSO  C51A  and  the 
post-crash  fire  environment  of  an  actual  A/F/T,  flame  heat  transfer 
phenomena  must  be  fully  understood.  A  literature  search  was  undertaken 
early  in  the  program  in  order  to  attain  an  understanding  of  flame  dynamics 
and  heat  transfer  within  a  flame  environment.  Several  references  were 
in  close  agreement  with  each  other  and  all  proposed  the  same  basic 
equations.  The  best  and  most  thorough  reference  will  be  utilized  through¬ 
out  this  section;  it  was  supported  by  test  data  and  it  specifically 
dealt  with  JP-4  fuel  fires.8 

The  energy  balance  equation  for  an  object  completely  enveloped  in  a 
flame  is  as  follows: 

qr  +  h  (Tf  -  T)  =  co  (T4) 


8J.  R.  Welker  and  C.M.  Sliepcevich,  "Heat  Transfer  by  Direct  Flame 
Contact  -  Fire  Test  -  Phase  I",  final  report  prepared  for  the  National 
Academy  of  Sciences,  July  1971. 
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where , 

q  =  radiant  heat  flux  from  the  flame, 

r  (BTU/hr-ft2) 

h  =  convection  heat  transfer  coefficient, 

(BTU/hr-ft2-°F) 

=  flame  temperature,  (°R) 

T  =  surface  temperature  of  enveloped  object, 

(°R) 

£  =  surface  emissivity  of  object,  (unitless) 

a  =  Stefan-Boltzman  constant,  (BTU/hr-ft2-°F) 

=  . 1714E-8 

It  is  necessary  to  handle  the  flame  heat  transfer  in  such  an  uncon¬ 
ventional  manner  because  (1)  the  radiation  heat  flux  from  the  flame  to  a 
solid  object  does  not  behave  in  accordance  with  a  normal  Stefan-Boltzman 
relationship,  and  (2)  the  flame  is  transparent  to  the  radiation  heat 
transfer  from  the  object  to  its  surroundings.  In  the  above  energy 
balance  equation,  the  radiant  heat  flux  term  for  JP-4  flames  can  be 
evaluated  with  the  following  equation: 

qr  =  FA(l-e 

where 

F  =  view  factor  (unitless)  =  1.0  for  100% 

envelopement  and  .5  for  50%  envelopment 

A  =  maximum  possible  heat  flux,  (BTU/hr-ft2) 

=  31,000  for  JP-4 

b  =  extinction  coefficient,  (in.  *)  =  .0186 

for  JP-4 

L  =  diameter  of  flame,  (in) 

This  equation  states  that  a  20.6-foot  diameter  flame  is  necessary 
in  order  to  attain  99  percent  of  the  maximum  possible  radiant  heat  flux. 

A  3.1-foot  diameter  flame  will  emit  50  percent  of  the  maximum  radiant 
heat  flux  and  a  6-inch  diameter  flame,  11  percent.  The  heat  transfer 
coefficient  for  convection  is  5  BTU/hr-ft * -°F  in  a  typical  JP-4  flame, 
and  the  flame  temperature  (T^)  is  2450°F  (1343°C). 
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As  can  be  seen  by  the  above  equations,  the  temperature  of  an  object 
completely  enveloped  by  a  flame  will  have  a  steady  state  surface  tempera¬ 
ture  which  is  dependent  upon  the  flame  diameter  and  the  emissivity  of 
its  surface.  Figure  15  graphically  shows  the  effect  of  emissivity  and 
flame  diameter  on  an  object  completely  submerged  and  50  percent  envelopec 
by  the  listed  JP-4  flame  environments.  A  hasty  conclusion  can  be  drawn 
that  aluminum  with  a  low  emissivity  (0.02  to  0.3),  will  reach  its  melting 
temperature  in  most  any  JP-4  flame.  The  fallacy  is  that  just  small 
amounts  of  soot  accumulation  will  drastically  change  the  emissivity  of  a 
surface.  With  .001  to  .002  inches  of  soot,  the  emissivity  of  stainless 
steel  will  increase  through  up  to  .99. 9  In  addition,  surface  oxidation 
and  temperature  increases  both  tend  to  increase  the  emissivity.  A 
conservative  assumption  for  the  emissivity  of  metals  enveloped  in  a  jet 
fuel  fire  with  some  soot  accumulation  present  is  that  the  £  is  equal  to 
.90, 


As  stated  above,  the  A/F/T  fire  protection  requirement  should 
simulate  at  least  major  fire  damage  (i.e.,  burnthrough  and  some  puddling). 
With  this  premise,  figure  15  shows  that  a  13-inch  diameter  JP-4  fuel 
flame  is  necessary  to  produce  some  puddling  of  aluminum.  The  15-minute 
oven  test  is  an  equivalent  environment  to  that  which  exists  when  the 
CSMU  is  completely  enveloped  in  a  13-inch  diameter  flame,  for  15  minutes. 
This  is  a  much  more  severe  test  than  the  TS0  requirement.  The  TS0  would 
allow  the  manufacturer  to  shield  50  percent  of  the  surface  area,  and 
utilize  a  6-inch  diameter  lower  temperature  flame  to  envelope  the  remaining 
50  percent  of  the  area.  The  proposed  test  will  result  in  a  CSMU  maximum 
memory  temperature  which  is  54°  hotter  than  that  encountered  in  a  TS0 
type  of  requirement.  In  addition,  the  armor  plate  will  reach  739°C  as 
opposed  to  489°C. 

A  flame  test  literally  defies  standarization.  Just  a  few  of  the 
parameters  which  would  effect  flame  test  results  are  fuel  flow  rate, 
oxygen  supply,  soot  accumulation,  flame  temperature  measurement  errors, 
fuel  chemisty,  atmospheric  conditions,  burner  construction  and  adjust¬ 
ment,  and  countless  others.  With  this  in  mind,  a  computer  thermal 
analysis  of  the  CSMU  completely  enveloped  in  a  13-inch  diameter,  JP-4 
fuel  flame  was  performed.  The  same  computer  model  was  used  to  arrive  at 
an  equivalent  oven  test,  in  which  the  time-temperature  profile  of  the 
enclosed  memory  chips  would  be  nearly  identical.  An  oven  temperature  of 
750°C  (1382°F),  for  15  minutes  is  recommended.  It  is  necessary  to 
increase  the  oven  temperature  90°C  above  the  melting  point  of  aluminum, 
to  account  for  the  lower  radiation  and  convection  heat  transfer  rates 
which  occur  in  an  oven,  versus  a  flame  environment. 


9L.H.  Russell  and  J.A.  Canfield,  "Experimental  Measurement  of  Heat 
Transfer  to  a  Cylinder  Immersed  in  a  Large  Aviation  Fuel  Fire",  Journal 
of  Heat  Transfer,  Transactions  of  the  ASME,  August  1973,  p.  399. 
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Figure  15.  Steady  State  Surface  Temperature  versus 
Emissivity  for  Several  Flame  Environments 
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The  recommended  fire  protection  test  for  the  CSFDR  CSMU  is  the 
stabilizing  of  the  unit  at  room  temperature  (21°C),  within  .3  minutes 
placing  it  in  a  750°C  oven,  removing  it  after  15  minutes,  and  allowing 
it  to  naturally  cool  down,  on  an  adjacent  bench  at  room  temperature 
(21°C).  This  is  equivalent  to  operating  the  CSMU  at  71°C,  subjecting  it 
to  a  15-minute  13-inch  diameter  flame-enveloped  ambience,  and  then 
allowing  it  to  cool  down  naturally  in  a  71°C  ambience.  It  is  antici¬ 
pated  that  the  15-minute  test  duration,  as  opposed  to  5  minutes,  will 
more  than  offset  the  2-8  hour  cool  down  period  encountered  in  most 
actual  A/F/T  mishaps.  This  recommended  test  will  be  easily  performed 
and  easily  standardized.  It  will  result  in  a  CSMU  design  which  will 
demonstrate  acceptable  field  fire  protection  performance. 

e.  Water  protection  requirement  (TSO  C51A).  The  FAA  require¬ 
ment  is  the  "intelligence  of  the  record  medium  shall  be  capable  of 
remaining  permanent  and  reproducible  after  the  record  medium  has  been 
immersed  in  seawater  for  36  hours".  Using  IC  memory  technology,  an 
extended  life  in  saltwater  immersion  is  easily  attainable.  A  mandatory 
survival  period  of  36  hours  in  a  salt  bath  is  recommended  for  this 
program. 

Specifying  a  longer  test  requirement  will  serve  no  purpose,  while 
it  will  significantly  increase  test  time,  cost,  and  program  schedule. 

3. 1.3.3  Recommended  test  conditions  -  adequately  specifying  the 
details  of  the  crash-survivability  test  conditions  is  as  critical  to  the 
program  as  determining  the  proper  requirement  levels.  Some  of  the 
details  have  been  touched  upon  already  and  will  not  be  repeated  in  their 
entirety,  below.  This  section  will  be  dealt  with  in  six  parts:  the 
first  deals  with  the  recommended  test  sequence,  and  the  last  five  deal 
with  the  specifics  of  each  of  the  five  basic  crash-survivability  test 
condit ions . 


a.  Recommended  crash- survivabi 1 i ty  test  sequence.  The  hard¬ 
ware  which  will  be  subjected  to  crash-survivability  testing  should  first 
be  subjected  to  a  simulated  life  test.  Two  test  approaches  are  possible. 
The  first  would  be  to  subject  a  CSFDR  system  to  its  qualification  testing 
prior  to  the  crash-survivability  testing  of  the  CSMU  alone.  A  second 
approach  would  be  to  subject  a  qualification  test  system  to  qualification 
testing,  while  an  additional  CSMU  would  be  provided  for  crash-surviva¬ 
bility  testing  alone.  This  second  approach  would  be  desirable  from 
several  aspects,  including  program  scheduling.  If  this  parallel  testing 
is  initiated  or  if  crash-survivability  testing  only  is  required  (because 
of  some  redesign,  proposed  improvement,  or  memory  expansion),  the  sur¬ 
vivability  test  article  should  be  subjected  to  simulated  life  testing 
initially. 
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It  is  recommended  that  the  Air  Force  specify  minimum  requirements 
for  the  simulated  life  testing.  The  test  methods  of  MIL-STD-810C  should 
be  followed.  The  requirements  should  include  the  following: 

•  Temperature  shock  -  three  complete  temperature  shock 
cycles  from  +71  to  -57°C,  with  4-hour  stabilization 
periods,  and  5-minute  ambient  shock  excursions  between 
the  two  extremes. 

•  Temperature-humidity-altitude  -  four  24-hour  cycles 
including  0  to  50,000  feet,  -54  to  +65°C,  and  up  to  95 
percent  RH  exposure. 

•  Temperature-altitude  -  exposure  to  0  to  70,000  feet 
altitude,  -54  to  +71°C  continuous  operation,  +71  to  +95°C 
intermittent  operation,  and  -62  to  +95°C  non-operating 
environments . 

•  Salt  fog  -  48-hour  exposure  to  a  salt  fog  environment. 

•  Vibration  -  1-hour  endurance  random  vibration  exposure  in 

each  axis  is  recommended,  in  accordance  with  MIL-STD-810C, 

figure  514.2-2A,  with  W  equal  to  .2  g1 2 3 4 5 6/Hz  (16.4  G  ). 

°  ’  o  ^  rms 

•  Humidity  -  240-hour  exposure  to  85  to  95  percent  RH  and 
temperature  cycling  from  28  to  65°C. 

•  Rain  or  fresh  water  immersion  (optional)  -  2-honr  rain 
exposure  (MIL-STD-8 10C ,  Method  506.1,  Procedure  II)  or  a 
2-hour  immersion  test  (MIL-STD-810C,  Method  512.1, 
Procedure  I)  could  be  optional  simulated  life  testing 
requi rements . 

Low  pressure,  high  temperature,  low  temperature,  fungus,  dust, 
explosive  atmosphere,  acceleration,  shock,  and  gunfire  vibration  testing 
were  all  omitted  from  this  simulated  life  testing.  They  will  add  very 
little  to  the  intent  of  this  test  requirement  and  will  !<*  included  as 
normal  qualification  test  requirements. 

The  sequence  to  be  followed  in  the  crash-survivability  testing  is 
very  important  and  should  be  specified  by  the  Air  Force.  The  following 
sequence  is  recommended: 

(1)  simulated  life  testing 

(2)  impact  shock 

(3)  penetration  resistance 

(4)  static  crush 

(5)  fire  protection 

(6)  water  immersion 
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With  the  exception  of  the  first  test,  this  is  the  same  sequence 
specified  in  paragraph  7.8  of  TSO  C51A.  Humidity  testing  is  included  in 
a  more  realistic  simulated  life  test  requirement.  The  mandatory  test 
sequence  is  a  natural  requirement.  It  follows  the  same  sequence  of 
events  which  may  transpire  during  an  A/F/T  mishap. 

The  memory  capacity  of  the  CSMU  should  be  stored,  and  verified, 
with  data  prior  to  the  start  of  simulated  life  testing.  At  the  con¬ 
clusion  of  each  of  the  six  test  requirements,  the  data  should  be  retrieved 
and  verified  for  accurate  data  retention.  Care  should  be  exercised  so 
that  the  read/verify  operation,  does  not  in  any  way,  recharge  or  restore 
the  memory  data  retention  capability.  No  repair  or  maintenance  of  the 
test  article  should  be  allowed.  The  Air  Force  should  establish  minimum 
pass/fail  performance  levels  for  crash-survivability  testing.  It  would 
seem  reasonable  to  allow  for  a  small  fraction  of  the  bit  locations  to  be 
randomly  in  error.  Ground  software  can  easily  flag  obvious  discrepancies 
in  actual  stored  mishap  data.  Regardless,  minimum  pass/fail  performance 
levels  should  be  clearly  stated. 

b.  Impact  shock  test.  The  200  to  250-g,  15-millisecond 
impact  shocks  should  be  performed  first,  followed  by  the  1700-g,  5  to 
8-millisecond  duration  pulses.  One  pulse  in  each  direction  of  each  of 
the  three  mutually  perpendicular  axes,  should  be  accomplished  at  the 
lower  g  level,  before  proceeding  to  the  primary  shock  pulse  requirement. 
This  sequence  of  testing  further  justifies  omitting  a  snock  requirement 
from  the  simulated  life  testing. 

As  stated  earlier,  the  shock  levels  should  be  specified  similar  to 
M1L-STD-810C,  figure  516.2-1.  Reasonable  tolerance  limits  on  each  of 
the  variables  should  be  clearly  stated.  Terminal  peak  sawtooth  shock 
pulses  should  be  simulated  in  an  accurate,  repeatable  test  procedure, 
using  high-quality  shock  test  equipment. 

Aerospace  industry  standard  shock  equipment  can  be  utilized  for  the 
low-level,  long  duration  shock  pulse.  The  primary  shock  pulse  will 
require  an  elastic  shock  cord  accelerated  drop  testing  rig,  an  air 
cannon,  or  a  jet  sled-barricade  impact  apparatus.  The  cheapest  testing 
alternative  will  be  exercised,  while  maintaining  the  shock  pulse  accu¬ 
racies  specified.  Accurate  monitoring  equipment  and  accelerometers  will 
be  utilized.  Complete  and  accurate  test  documentation  should  be  required. 

c.  Penetration  resistance  test.  Two  drop  tests  are  required, 
one  in  each  direction  of  the  most  critical  plane.  An  attempt  should  be 
made  to  standardize  this  test  by  specifying  the  following: 

•  Impact  point  material,  size,  shape,  and  length. 
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•  Construction  and  design  of  the  drop  weight,  including  its 
size,  length,  and  acceptable  impact  point  structural 
attachment . 

•  Test  fixturing  guidelines  should  be  determined  for  the 
guide/guide-rail  assembly,  the  quick  release  drop  mechanism, 
and  the  impact  measurement  equipment. 

•  Support  media  for  the  test  article  -  allowable  sand 
density,  grain  size,  cross-sectional  area,  and  depth. 

•  The  requirement  to  monitor  the  resultant  shock  pulse 
should  be  specified  (an  accelerometer  attached  to  one  of 
the  unused  mounting  flanges  will  suffice). 

It  will  be  important  to  clearly  specify  a  test  requirement  of  this 
nature.  The  Air  Force  deserves  the  hardware  penetration  worthiness 
which  they  are  expecting  and  the  suppliers  v/ill  be  able  to  arrive  at  a 
truely  optimum  design.  Test  standardization  is  essential  if  the  design 
worthiness  of  competitive  designs  and  the  design  worthiness  of  multiple 
sources,  are  to  be  realistically  compared. 

d.  Static  crush  test.  The  static  crushing  load  will  be 
applied  for  5  minutes  sequentially,  in  each  of  the  three  mutually  per¬ 
pendicular  axes.  A  materials  tensile/compression  test  machine  can  be 
utilized.  The  apparatus  will  be  fixtured  so  that  the  applied  loads  are 
uniformly  distributed  over  the  primary  flat  surfaces  in  each  direction. 

The  crushing  loads  will  not  be  applied  to  the  projected  mounting  feet, 
connector,  or  heads  of  screws  attaching  the  cover.  If  the  crushing 
loads  are  to  be  applied  to  these  protruding  physical  features  of  the 
chassis,  it  should  be  clearly  stated.  The  proposed  design  will  pass 
either  test  but  a  memory  readout  will  be  more  difficult  if  the  connector 
is  damaged  in  the  static  crush  test. 

e.  Fire  protection  test.  The  uncontrollable  and  unstandard- 
izable  nature  of  flame  testing,  mandates  the  need  to  specify  an  oven 
test.  Industry  studies  have  arrived  at  this  same  conclusion,  "...all 
such  recorders  must  be  tested  under  identical  conditions.  This  can  only 
be  effected  by  establishing  a  more  definitive  standard  test  method,  thus 
eliminating  variations  in  testing  procedures  as  exist  at  present....  A 
suitable  and  uniform  test  method. . .would  be  insertion  of  the  complete 
recorder  for  30-minute  duration  in  an  electric  furnace  operating  at 
1600°F."10  The  oven  test  is  recommended  as  an  essential  change. 


10Thomas  Rust,  Jr  and  Paul  N.  Boris,  "Fire  Test  Criteria  Fur 
Recorders",  NAFEC ,  Atla  itic  City,  N.J.  Final  report  prepared  tor  the  FAA 
(Report  No.  FAA-DS-70-16) ,  July  1970,  pp.  2,  34. 
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A  15-minute  oven  test  is  adequate,  based  on  the  fact  that  the  vast 
majority  of  A/F/T  post-crash  fires  are  extinguished  in  less  than  5  minutes. 
The  additional  10  minutes  of  test  will  adequately  account  for  the  post- 
fire,  cool-down  temperature  profile,  which  exists  as  the  aircraft  wreckage 
gradually  cools  down  to  the  outside  ambience.  The  750°C  (13b0°F)  is 
based  on  mishap  fire  damage  data,  and  its  determination  is  well  supported 
in  the  previous  section  above.  If  the  crash-protected  memory  unit  were 
to  be  installed  in  the  cockpit  or  avionics  bay  of  an  A/F/T,  where  equip¬ 
ment  is  much  more  prone  to  fire  damage,  the  870°C  (1600°F)  oven  temperature 
is  probably  warranted. 

The  proposed  test  is  as  follows: 

(1)  Stabilize  the  CSMU  temperature  at  room  tempera¬ 
ture  (2 1°C) . 

(2)  Place  the  unit  in  a  750°C  preheated  oven  for  15  min¬ 
utes  duration. 

(3)  Remove  the  CSMU  from  the  oven  and  allow  it  to  natur¬ 
ally  cool  down  at  room  temperature  (21°C). 

(4)  Upon  returning  to  near  room  temperature  stabilization, 
a  minimum  of  1  to  3  hours  later,  the  data  retention  should  be  verified. 

The  test  specification  and  testing  procedures  should  also  state  the 
following  limitations.  An  electric  furnace  is  desirable.  It  should  be 
well  insulated,  and  capable  of  a  quick  response  in  recovering  from  the 
temperature  drop  induced  as  the  test  article  is  transferred  into  the 
oveu.  The  transfers  should  be  accomplished  as  quickly  as  possible 
(within  .2  to  .3  minutes)  and  the  oven  should  be  back  up  to  750°C, 
within  the  first  minute  of  the  15-minute  test  period.  The  oven  air 
temperature  should  be  maintained  at  750-775°C  and  all  six  walls  of  the 
furnace  exposed  to  the  test  article,  should  be  within  25°C  of  the  air 
temperature.  The  unit  should  be  placed  in  the  center  of  the  furnace,  in 
a  normal  mounting  orientation,  and  be  supported  by  a  perforated  metal 
shelf.  During  the  room  temperature  cool  down,  artificial  cooling  should 
not  bt  allowed,  such  as  quenching  or  impingement  of  moving  air.  Agaiu, 
a  perforate;!  shelf  or  metal  grate  is  recommended  as  a  support  shelf. 

f.  Water  protection  test.  This  test  should  simulate  seawater 
immersion  of  the  recorder  for  a  period  of  36  hours.  A  seawater  solution 
of  a  specified  salt  concentration,  PH  level,  and  room  temperature  should 
he  prepared.  The  test  article  should  be  immersed  in  the  solution,  so 
that  its  uppermost  point  is  at  least  36  inches  below  the  surface.  The 
test  should  be  conducted  at  a  reasonably  low  altitude,  with  ambient 
atmospheric  pressure. 
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3. 1.3. 4  Crash  protection  evaluation  -  Physical,  mechanical,  and 
thermal  control  techniques  are  compared  and  evaluated  for  the  protection 
of  the  memory  module  from  the  effects  of  A/F/T  crashes.  The  following 
sections  will  deal  with  the  crash  protection  schemes  considered  during 
this  study  program.  The  sections  are  (1)  remote  memory  mounting,  (2) 
memory  module  design  concept,  (3)  thermal  protection/insulation  evaluation, 
(4)  mechanical  protection/armor  evaluation,  and  (5)  memory  locating 
aids . 


a.  Remote  memory  mounting.  The  single  most  distinctive,  and 
ultimately  the  most  superior  feature  of  the  design  approach  is  the 
remote  memory  mounting  of  the  CSMU.  The  CSMU  was  designed  to  be  installed 
in  a  remote  location  on  the  aircraft.  The  processor  (DPU)  can  be  installed 
in  the  avionics  bay  where  the  signals  are  readily  available,  while  the 
crash-protected  memory  is  located  in  the  more  crash-benign  extremities 
of  the  aircraft.  There  can  be  no  argument  with  the  conclusions  drawn 
from  the  mishap  data.  The  wings,  tail,  and  tail  cone  of  the  aircraft 
receive  a  much  lower  level  of  fire  and  mechanical  damage. 

Thus,  the  remote  memory  concept  is  absolutely  essential  to  an 
optimum  CSFDR  system  design.  Installing  an  entire  system,  processor  and 
memory,  *n  the  avionics  bay  will  either  decrease  its  survivability  or 
increase  the  size,  weight,  and  cost  of  the  mechanical  and  fire  protection 
required.  Installing  both  in  the  extremities  will  increase  cabling 
weight,  increase  installation  cost,  and  decrease  accessability  to  the 
hardware . 

The  remote  memory  concept  came  under  consideration  very  early  in 
this  study  program.  The  functional  breakdown  between  the  DPU  and  the 
two  sections  of  the  CSMU  were  important  in  optimizing  this  concept.  The 
CSMU  contains  a  crash-protected  section,  in  which  only  the  crash-protected 
memory  (CPM)  is  mounted,  and  the  non-survivable  timing  and  control 
section,  contained  on  a  single  printed  circuit  board.  With  this  func¬ 
tional  breakdown,  the  interconnect  between  each  of  the  three  sections  is 
minimized.  There  are  only  14  assigned  signal  lines  between  the  DPU  and 
the  CSMU,  which  minimizes  cable  size  and  weight. 

Early  in  the  study  program,  an  evaluation  was  made  of  a  multiple 
semi-hardened  CSMU  configuration.  In  this  concept  a  single  processor 
would  feed  data  to  several  CSMU  designs.  They  would  contain  little  or 
no  thermal  protection  and  a  minimum  amount  of  mechanical  protection. 

Several  semi-hardened  CSMUs  would  be  installed  in  each  aircraft,  in  the 
hope  that  at  least  one  would  survive.  Potential  installation  locations 
included  the  canopy  rail,  ejection  seat,  wing  tips,  and  vertical  tail. 

The  real  drawback  to  such  a  design  is  (1)  cost  to  install  multiple 
memories,  (2)  cable  weight  and  cost  to  interconnect  multiple  memories, 
and  (3)  cost  impact  with  multiple  CPM  modules.  Just  the  CPM  module,  by 
itself,  is  a  significant  portion  of  the  total  CSFDR  system  hardware 
cost.  The  memory  components  themselves  are  very  expensive.  Figure  16 
shows  a  design  concept  sketch  of  the  semi-hardened  CSMU  design.  Each 
unit  would  be  less  than  13  cubic  inches  in  size,  and  a  weight  of  1  pound 
would  be  a  reasonable  design  goal. 
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A  single,  fully  crash-protected  and  remotely  mounted  CSMU  does  not 
suffer  from  any  of  these  shortcomings.  Hardware  and  installation  cost, 
size,  and  weight  are  minimized,  while  maximum  survivability  is  attained. 

The  point  cannot  be  over-emphasized:  the  remote  memory  mounting  is 
a  very  effective  survivability  protection  feature.  Minimizing  the 
severity  of  the  post-crash  environment  is  a  very  attractive  alternative 
to  added  insulation  and  increased  armor  thickness. 

b.  Memory  module  design  concept.  The  design  of  the  CPM 
module  was  critical  to  the  overall  crash-protection  design  of  the  CSMU. 

In  order  to  aid  the  overall  thermal  and  mechanical  worthiness  of  the 
design,  the  CPM  had  to  be  as  rugged  and  as  small  as  possible,  and  yet  be 
cheap  to  build  in  large  'olume  production.  Three  CPM  designs  received 
considerable  consideration.  They  were  (1)  a  cubical  stacking  design, 

(2)  a  fluid-filled  module  design,  and  (3)  a  single  card  design. 

Early  in  the  study  program,  it  became  obvious  that  the  size  and 
shape  of  the  CPM,  its  protective  insulation,  and  its  armor  enclosure 
were  to  be  important  considerations.  For  a  given  memory  capacity  require¬ 
ment,  the  needed  volume  to  package  alternately-shaped  CPM  modules  is  not 
constant.  Some  shapes,  and  their  resulting  packaging  concepts,  lend 
themselves  to  higher  packaging  density  and  more  efficient  volume  utiliza¬ 
tion.  However,  if  the  following  assumptions  are  true,  some  very  inter¬ 
esting  conclusions  can  be  drawn. 

•  Assume  that  a  spherical,  cubical,  and  rectangular  CPM 
design  can  be  packaged  in  the  same  volume. 

•  Assume  that  the  insulation  and  armor  enclosure  thicknesses 
are  identical  in  all  three  designs. 

•  Assume  that  the  insulation  and  armor  adopt  the  same  shape 
and  aspect  ratios  as  the  module  they  are  encompassing. 

With  these  assumptions,  the  conclusions  are  as  follows: 

•  The  thermal  time  constant  of  the  sphere-shapeu  ign 
would  be  the  longest,  followed  by  the  cube,  and  .en  the 
rectangular  design.  This  is  because  the  volume  to  surface 
area  ratio  of  a  sphere  is  the  highest.  When  subjected  to 
a  flame  or  oven  ambient,  the  sphere  would  be  the  slowest 
to  increase  its  temperature.  However,  upon  removal,  it 
would  also  be  the  slowest  to  cool  down.  A  more  rigorous 
thermal  analysis  would  show  a  slight  thermal  performance 
advantage  for  the  sphere,  because  of  its  smaller  outside 
surface  area  and  lower  armor  thermal  capacitance. 
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*  The  static-crush  and  penetration  resistance  of  the  sphere 
would  be  the  highest,  followed  by  the  cube,  and  then  the 
rectangle.  The  spherical  armor  has  much  more  strength 
and  toughness  because  of  its  localized  three-dimensional 
nature,  while  the  cube  has  shorter,  unsupported  spans 
than  the  rectangular  prism. 

•  The  total  volume  of  the  insulation  and  armor  are  smallest 
for  the  sphere,  followed  by  the  cube,  and  then  the  rec¬ 
tangular  prism.  If  a  1-cubic-inch  CPM  module  is  assumed 
and  if  the  insulation  and  armor  thicknesses  are  .8  inches 
and  .125  inches,  respectively,  the  following  volumes 
would  result.  For  the  spherical  concept,  the  CPM  would 
have  a  diameter  of  1.24  inches,  the  outside  diameter  of 
the  armor  would  be  3.09  inches,  and  its  total  volume 
would  be  15.5  cubic  inches.  For  a  1-inch  cube  CPM,  the 
armor  would  be  2.85  cubic  inches,  and  its  total  volume 
would  be  23.2  cubic  inches.  For  the  rectangular  concept, 
if  the  CPM  is  2x2x.25  inches,  the  armor  would  be 
3.85x3.85x2.10  inches,  and  its  total  volume  31.1  cubic 
inches . 

If  only  thermal  performance,  mechanical  strength  of  the  armor,  and 
total  volume  were  to  be  considered,  the  proposed  design  would  definitely 
be  spherical  in  shape.  The  cubic  concept  would  be  a  second  choice  and 
the  rectangular  a  distant  third.  However,  total  cost,  packaging  ineffi¬ 
ciencies,  interconnect  problems,  aircraft  installation  considerations 
and  countless  other  considerations  have  to  be  examined. 

The  spherical  CPM  was  not  given  further  consideration,  as  was  noted 
above.  The  CPM  packaging  density  would  be  tremendously  reduced  in  order 
to  accommodate  the  spherical  shape.  The  CPM  volume  could  easily  approach 
2  cubic  inches,  raising  the  outside  diameter  3.5  inches  and  the  total 
volume  to  22.5  cubic  inches.  The  volume,  thermal,  and  even  weight 
advantages  would  be  negated  by  inefficient  space  utilization.  Existing 
automated  manufacturing  and  assembly  equipment  could  not  be  employed, 
resulting  in  exorbitant  cost  figures  for  high-volume  production.  Advanced 
and  totally  unproven  packaging  and  manufacturing  technologies  would  be 
required  in  order  for  the  spherical  concept  to  become  even  reasonably 
competitive  from  a  CPM  cost  standpoint.  Another  problem  is  the  inefficient 
utilization  of  aircraft  space.  The  rectangular  design,  with  its  smallest 
dimension  being  only  2.1  inches,  can  be  installed  in  more  of  the  available 
aircraft  locations  than  a  spherical  unit  with  a  3.5-inch  minimum  dimension. 
Wing  tip  and  vertical  ta-1  installations  would  be  difficult  or  impossible. 
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The  stacked  and  fluid-filled  CPM  module  designs  were  both  conceived 
as  cubic  configurations.  These  two  concepts  solve  many  of  the  shortcomings 
of  the  spherical  configuration  and  yet  they  are  still  less  than  optimum 
designs . 

The  stacking  design  involves  assembling  the  CPM  module  by  vertically 
stacking  several  flat,  square  modules.  Its  advantages  include  modular 
memory  expansion  accomplished  by  adding  layers  to  the  stack,  multiple 
use  of  identical  modules,  and  ease  of  servicing.  The  insurmountable 
problem  with  this  design  is  the  module-to-module  interconnect  requirement. 
Memory  ci-cuit  interconnect  demands  are  extremely  high.  Even  the  most 
exotic  and  advanced  connection  schemes  possible  resulted  in  utilizing  50 
percent  of  the  total  CPM  volume  for  module-to-module  interconnect.  An 
inherent  risk  with  these  module  interconnect  schemes  is  their  question¬ 
able  gas-tight  qualities  and  their  unproven  reliability.  The  interconnect 
problems  were  insurmountable  without  introducing  significant  program 
risk.  This  stacking  CPM  design  concept  is  not  recommended. 

The  second  CPM  concept  pursued  was  mounting  the  memory  components 
directly  to  a  printed  flexible  circuit,  folding  the  assembly  info  a 
desirable  shape,  and  installing  it  in  a  fluid-filled  sealed  enclosure. 

The  fluid-filled  module  would  be  non-repairable  and  inaccessible  for 
maintenance  and  trouble  shooting.  The  memory  component  to  flex  circuit 
mounting  is  an  unproven  process,  with  possible  susceptibility  to  mechanical 
damage,  during  thermal  shock  and  cyling.  The  major  shortcoming  of  this 
design  is  the  cost  to  seal  the  enclosure  with  enough  strength  to  withstand 
the  impact  shock  requirements  and  the  high  temperature  excursions,  with 
resultant  pressure  buildup. 

The  CPM  design  concept  which  is  recommended  is  the  single  flat  card 
design.  This  design  utilizes  existing  technology  and  proven  processing 
techniques.  The  design  is  simple,  repairable,  low-cost,  and  extremely 
rugged.  The  design  efficiently  utilizes  available  volume  and  the  inter¬ 
connect  scheme  is  extremely  reliable  and  proven. 

Parallel  to  the  study  program,  a  considerable  effort  was  undertaken 
to  arrive  at  an  optimum  design  utilizing  this  single  flat  card  concept. 

In  all  three  concepts,  the  use  of  discrete,  hybrid,  or  custom  monolithic 
microcircuit  technologies  were  seriously  considered.  The  recommended 
design  is  a  very  creative  solution  which  solves  memory  interconnect 
problems,  minimizes  CPM  power  dissipation,  minimizes  the  critical  size 
parameters,  and  still  features  some  very  attractive  data  retrieval  and 
repairability  features.  While  exhibiting  these  distinctive  and  essential 
qualities,  our  CPM  design  utilizes  existing  technology,  rugged  mechanical 
performance  is  assured  (see  appendix  E),  and  the  assembly  cost  will  be 
low.  The  CPM  component  cost,  while  not  inexpensive,  will  be  lower  or 
competitive  with  other  designs  and  configurations  which  utilize  similar 
or  alternate  technologies. 
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c.  Thermal  protection/insulation  evaluation.  The  search  for 
an  optimal  CSMU  thermal  insulation  included  both  vacuum  super-insulations 
and  ambient  pressure  insulations.  Thermal  protection  schemes  considered 
included  thermoelectric  coolers,  intumescent  thermal  protection  coatings, 
heat-fuseable  leads,  mechanically-shearing  leads,  a  bimetalic  heat 
column,  capacitive  heat  sinking  material  (including  water-soaked  wicks, 
water-permeated  mineral  fiber,  and  water  bags),  heat  pipes,  and  high 
thermal  capacitance  potting  gels  or  fluids.  The  proposed  design,  using 
solid  ambient  pressure,  Johns-Manville  Min-K-1301  insulation  is  the  best 
solution.  It  provides  the  maximum  protection,  while  minimizing  cost, 
maintainability,  simplicity  of  design,  size,  and  weight. 

The  thermal  conductivity  of  Johns-Manville  Min-K-1301  insulation  is 
.0208  BTU/hr-ft-°F  (.036  W/M-°C)  at  800°F  (425°C) .  There  are  available 
vacuum  super-insulations  which  have  thermal  conductivities  which  are 
10  to  1000  times  lower  than  Min-K.  However,  they  must  be  maintained  in 
a  vacuum  ambience  to  exhibit  their  super  insulation  qualities.  At 
normal  ambient  pressures,  their  thermal  conductivity  exceeds  that  of 
Min-K.  A  vacuum  insulation  scheme  is  not  recommended. 

Over  the  life  time  of  an  A/F/T,  any  vacuum  design  would  lose  its 
vacuum  and  require  recharging.  Even  metals  slowly  pass  molecules  of  gas 
through  their  thickness.  Even  worse,  these  insulations  (which  are  con¬ 
structed  of  multi-layered  metal  foils,  vacuum  deposited  on  thin  films  of 
Mylar,  Kapton,  or  similar  plastics)  slowly  outgas  and  contaminate  their 
own  ambient  vacuum  environment.  Expensive  designs  would  need  to  be 
employed  to  absorb  these  contaminants. 

Regardless  of  the  other  problems,  the  cost  increment  imposed  by  an 
evacuated  hermetically  sealed  CSMl  chassis  enclosure  would  be  cost-pro¬ 
hibitive  in  itself.  Glass-sealed  Kovar  feed-throughs  would  be  required 
to  electronically  connect  the  CPM  with  the  timing  and  control  electronics. 
The  penetration  and  impact  shock  protection  required  of  the  armor  plating 
would  have  to  be  upgraded.  Not  only  would  the  structure  have  to  survive 
impact  and  penetration  damage,  the  hermeticity  of  the  enclosure  would 
have  to  be  maintained.  In  extremely  small  quantity  production,  vacuum 
insulations  could  possibly  become  competitive.  In  the  large  quantity 
productions  required  of  the  CSFDR  program,  the  technical  problems  and 
cost  impact  seem  insurmountable.  The  insulation  thickness  savings  could 
easily  be  offset  by  the  added  mechanical  protection  required. 

Considering  only  ambient  pressure  insulations,  Min-K  is  unsurpassed 
in  insulation  qualities  at  the  CSFDR  high  temperatures,  ranging  from  400 
to  800°C.  (750-l470°F) .  In  addition,  Min-K  is  a  moldable  solid  insulation 

possesing  outstanding  mechanical  strength  and  durability.  Its  5%  compres¬ 
sion  strength  is  95  psi,  while  its  8%  value  is  190  psi.  As  will  be 
shown  in  a  later  section,  a  .8-inch  thickness  of  Min-K,  will  adequately 
protect  the  selected  MN0S  memories  during  the  vast  majority  of  A/F/T 
crashes . 
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Intumescent  thermal  protection  coating  was  considered  for  the  CSMU. 
The  molded  Min-K  insulation  surrounds  the  CPM.  The  insulation  and  CPM 
are  enclosed  in  an  armored  housing,  made  of  high-strength  steel  or 
titanium.  An  initial  concept  featured  an  intumescent  coating  applied  to 
the  outside  of  the  armor.  Intumescent  coating  is  a  paint  derivative, 
which  swells  5  to  50  times  its  original  thickness  when  exposed  to  high 
temperatures  (350°  to  500°F)  or  flame.  In  swelling,  the  material  forms 
a  charred  insulation  layer.  The  typically  cured  virgin  material  has  a 
density  of  .051  lbm. /cubic  inches  and  a  thermal  conductivity  of  .200  BTU/ 
hr-ft-°F,  while  the  char  properties  are  .022  and  .040,  respectively. 

The  char  thermal  conductivity  is  twice  that  of  Min-'<,  making  it  a  very 
good  insulation,  itself.  However,  the  real,  attractive  feature  of  intu¬ 
mescent  coating  is  it's  self-healing  qualities.  If  penetration  and 
impact  shock  were  to  locally  damage  the  insulation,  the  swelling  would 
tend  to  fill  any  resultant  voids. 

A  computer  thermal  analysis  of  the  proposed  CSMU  with  and  without 
f ' '  unescent  coating  was  performed.  The  characteristics  of  the  coating 
were  accurately  modeled  from  data  in  available  literature.  The  virgin 
thickness  of  the  coating  was  .020  inches,  while  the  char  thickness  was 
.100  inches,  a  conservative  expansion  ratio.  At  the  time  the  flame  was 
extinguished,  the  CPM  memory  was  45°C  cooler  with  the  coating  than 
witnout.  This  difference  expanded  to  85°C,  8  minutes  after  the  flame 
was  extinguished.  However,  21  minutes  after  flame  extinction,  the 
resultant  CPM  temperatures  crossed  and  the  CPM  with  coating  attained  a 
maximum  temperature  of  10°C  hotter  than  without.  What  is  even  worse, 
the  higher  CPM  temperatures  were  maintained  for  longer  periods  of  time. 

In  comparing  the  total  time-temperature  damage  to  the  MNOS  memory  chips, 
the  thermal  performance  of  the  one  with  coating  incurred  30%  more  thermal 
damage  to  the  memories.  The  damage  life  factors  are  3.3  and  ,>.0. 
respectively. 

This  thermal  phenomenon  is  easy  to  understand.  The  coating  is  a 
tremendous  aid  during  the  flame-exposure,  heat-up  phase,  but  it  becomes 
an  even  bigger  penalty  during  the  cool-down  phase.  The  thermal  energy, 
stored  in  the  high  thermal  capacitance  armor  plating,  is  retained  for 
longer  periods  of  time,  forcing  more  heat  energy  to  trickle  through  the 
insulation  to  the  CPM.  Thp  intumescent  coating  must  be  moved  inside  the 
armor  enclosure  to  be  effective.  Since  it  is  a  poorer  insulation  than 
Min-K,  it  is  not  included  in  our  recommended  configuration.  The  self- 
healing  features  still  make  it  an  attractive  alternative.  If  preliminary 
impact  and  penetration  testing  of  the  proposed  configuration  indicate 
that  significant  damage  to  the  Min-K  is  incurred,  incorporation  of 
intumescent  coating,  applied  to  the  inside  surface  of  the  armor  enclosure, 
is  an  easy  design  improvement  to  make. 
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The  normal  power  dissipation  of  the  proposed  CPM  is  9.1  mW.  This 
extremely  low  power  dissipation  is  essential  to  an  optimum  thermal 
design.  Since  the  CPM  requires  exceptional  thermal  insulation  to  sur¬ 
vive  the  fire  protection  requirement,  it  also  stands  the  risk  of  over¬ 
heating  during  normal  operation.  However,  at  9.1  mW,  the  thermal  rise 
during  normal  operation  will  be  .8°C  from  the  memory  junction  to  the 
CSMU  ambient.  At  extremely  high  data  storage  rates,  this  temperature 
rise  could  possibly  double  to  1.6°C. 

Many  of  the  thermal  protection  schemes  mentioned  above  were  con¬ 
sidered  as  possible  solutions,  if  the  electrical  interconnect  to  the  CPM 
became  a  significant  thermal  path  through  the  MIN-K  insulation.  As  it 
turns  out,  with  only  10  interconnect  lines  required,  the  thermal  resis¬ 
tance  of  the  flex  circuit  is  28:1  greater  than  the  total  thermal  resis¬ 
tance  of  the  insulation.  The  thermal  conductivity  of  copper  is  11,100 
times  larger  than  Min-K.  However,  the  effective  cross-sectional  area  is 
311,000  times  smaller. 

The  combination  of  low  thermal  conductivity  of  the  interconnect  and 
the  extremely  low  pov?er  dissipation  of  the  CPM,  eliminates  the  need  for 
thermoelectric  coolers,  heat  fuseable  leads,  shearing  leads,  heat  columns 
and  heat  pipes.  Normal  operating  temperature  rise  of  the  CPM  and  the 
thermal  shorting  of  the  insulation  by  the  interconnect  are  not  signifi¬ 
cant  problems  in  the  design  concept. 

Capacitive  heat  sinking  material  received  serious  consideration, 
but  each  had  serious  objections,  including  cost,  weight,  and  durability. 
Water  soaked  wicks  and  water  bags  present  a  serious  sealing  problem  and 
their  durability  to  survive  low  level,  long  duration  impact  shocks  is 
questionable .  The  durability  of  water  permeated  mineral  fiber,  through 
repeated  temperature  cycling,  above  and  below  the  freezing  point  of 
water,  is  doubtful.  High  thermal  capacitance  potting  gels  and  fluids 
are  attractive,  if  employed  inside  the  insulation  layer  and  surrounding 
the  CPM.  However,  insulation  contamination  with  moisture  and  enclosing 
the  material  in  a  sealed  containment  barrier,  becomes  difficult  and 
expens ive . 

Two  layers  of  insulation  were  also  considered.  A  high  temperature/ 
low  thermal  capacitance  insulation  surrounding  a  lower  temperature/high 
thermal  capacitance  insulation,  has  some  thermal  performance  advantages. 
The  problems  are  1)  the  thermal  capacitance  (p  x  Cp,  Btu/in3-°F)  of 
insulations  do  not  exhibit  a  wide  spread  in  value,  and  2)  the  cost  of 
each  layer  will  nearly  equal  the  cost  of  a  single  layer,  while  handling, 
storage,  assembly,  and  maintenance  cost  are  increased.  The  optimum  and 
simplest  thermal  design  solution  is  a  single  layer  of  Min-K  insulation. 
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d.  Mechanical  protection/armor  evaluation.  As  stated  earlier, 
the  penetration  resistance  requirement  of  the  CSMU  determines  the  armor 
thickness  required.  An  armored  enclosure,  which  survives  the  penetration 
test,  will  surely  perform  adequately  in  static  crush  and  impact  shock. 

High  strength  steel  (9  Ni-4  Co  steel,  in  accordance  with  AMS  6524)  and 
weldable  titanium  (TI-6  A1-4V,  in  accordance  with  M1L-T-9046)  are  the 
two  most  promising  armor  enclosure  materials.  High-strength-reinforced 
plastic  composites  have  received  some  consideration,  however,  the  high 
temperature  fire  protection  demands  exceed  their  maximum  service  temperature. 

In  penetration  testing,  the  drop  weight  will  be  traveling  25.38  fps 
at  impact,  if  released  from  10  feet  and  air  resistance  is  ignored.  If 
the  CSMU  is  placed  on  18  inches  of  dry  sand  (on  its  3.95-inch  x  3.8-inch 
surface),  the  projectile  sand  penetration  equations  predict  the  decelera¬ 
tions  and  drop  weight  will  be  16.63  g.  if  a  100  lbm.  weight  is  used. 

The  peak  force  on  the  armor  plate  will  be  the  mass  of  the  weight  times 
its  negative  acceleration,  or  1663  lbf . ,  applied  over  a  .25-inch  diameter 
circular  area.  If  a  factor  of  safety  of  1.5  is  introduced  by  increasing 
the  designed  load  from  1663  lbf.  to  2500  lbf.,  the  armor  thicknesses 
required  will  be  .153  inches  for  9  Ni-4Co  steel  and  .180  inches  TI-6A1-4V 
titanium  (reference  7).  The  tensile  ultimate  strengths  of  both  of  the 
materials  were  those  listed  in  MIL-HDBK-5B,  namely  220  and  160  ksi, 
respectively.  It  should  be  noted  that  these  calculations  agree  closely 
with  the  maximum  stress  levels  calculated  using  the  equations  from 
table  19.  Using  the  calculated  average  stress  ratios  between  rigid  and 
freely  supported  recorders,  the  maximum  stress  levels  for  a  9Ni-4Co 
steel  bar  would  be  176  to  337  ksi.  For  a  Ti-6A1-4V  bar  it  would  be  100 
to  191  ksi.  In  each  case,  the  lower  value  is  for  a  100-lbm.  drop  weight 
and  the  higher  values  for  a  500-lbm.  drop  weight. 

All  factors  considered,  the  proposed  CSMU  configuration  has  an 
armor  thickness  of  .153-inch-thick  9Ni-4Co  steel  or  .180-inch-thick 
Ti-6A1-4V  titanium.  These  are  currently  the  recommended  armor  thick¬ 
nesses  and  they  will  oe  the  initial  thicknesses  subjected  to  preliminary 
crash  testing.  Both  materials  are  weldable  and  both  have  their  advan¬ 
tages.  Titanium  has  the  advantage  of  lower  thermal  capacitance  and 
lighter  weight  while  steel  is  less  expensive  to  purchase  and  process. 

It  has  a  size  advantage  in  that  a  thinner  plate  can  be  utilized.  Steel 
has  a  higher  ultimate  strength  but  titanium  a  higher  specific  strength. 

e.  Memory  locating  aids.  TS0  C51A,  paragraph  8.0,  specifies 
that  the  exterior  of  the  recorder  must  be  finished  in  either  bright 
orange  or  bright  yellow,  to  aid  in  locating  the  device  amongst  the  post 
crash  debris.  It  is  recommended  that  the  requirement  be  carefully 
considered  by  the  Air  Force  along  with  two  other  feasible  locating  aids. 

They  are  magnetizing  a  portion  of  the  armored  enclosure  or  doping  the 
enclosure  with  low  level  radiation.  These  would  allow  the  use  of  either 
a  magnetic  or  radiation  detector  to  locate  the  CSMU. 


It  should  be  noted,  that  bright  distinctive  coating  requirement  has 
three  possible  disadvantages.  First,  it  is  not  in  agreement  with  standard 
Air  Force  case  finishes  specified  in  MIL-E-5400.  Secondly,  it  would 
impose  a  minor  thermal  impact  since  the  emissivity  is  low  and  the  increased 
thickness  and  lower  conductivity  of  a  durable  bright  coating  would  be 
less  than  desirable.  Third,  industry  studies  on  commercial  recorders 
have  met  with  mixed  success  as  to  the  crash/fire  durability  of  even  the 
best  and  most  expensive  coatings  available.  Air  Force  direction  is 
required  as  to  the  desirability  of  alternate  locating  aids. 

3.  1.3.5  Recommended  CSFDR  packaging  approach  -  The  recommended 
CSFDR  packaging  approach  will  be  illustrated  along  with  external  inter¬ 
faces.  The  physical  description,  packaging  approach,  thermal  surviva¬ 
bility  performance,  and  related  issues  will  be  described.  The  subsec¬ 
tions  are  (1)  Hardware  Description/Standard  Design  Requirements,  (2) 

MNOS  High-Temperature  Memory  Retention,  (3)  CSMU  Fire  Protection  Worthiness/ 
Thermal  Evaluation,  and  (4)  CSMU  Armor  Enclosure  Design. 

a.  Hardware  description/standard  design  requirements.  The 
hardware  description  and  the  standard  qua j i fication  requirements  of  the 
CSMU  and  DPU  will  be  described  below.  The  crash-protected  portion  of 
the  CSMU  will  be  qualified  to  the  crash  survivability  requirements  of 
the  program.  However,  the  remainder  of  the  system  should  be  required  to 
pass  standard  qualification  requirements  for  military  airborne  elec¬ 
tronics.  The  applicable  specification  levels  of  MIL-E-5400  and  the  test 
procedures  of  MIL-STD-810C  are  recommended.  Since  it  is  desired  to 
install  the  DPU  and  CSMU  in  any  A/F/T,  wherever  a  suitable  location  is 
available,  the  design  requirements  must  be  stringent  enough  to  maintain 
this  flexibility. 

The  10-g  sinusoidal  vibration  requirements  of  MIL-E-5400R,  figure  2, 

Curve  IVa,  is  ret.  mmended  for  both  the  CSMU  and  DPU.  The  curve  is  for 

equipment  installed  in  the  rear  half  of  the  fuselage  or  wing  area  of  jet 

aircraft.  A  random  vibration  requirement  in  accordance  with  M1L-STD-810C , 

figure  514.2-2A,  with  V  =  .2  g2/Hz  (16.4  G  )  would  also  be  acceptable. 

o  rms 

The  CSMU  and  DPU  design  concepts  are  worthy  of  passing  either  of  these 
design  vibration  requirements.  Either  the  random  or  the  sinusoidal 
vibration  requirements  should  be  specified. 


The  basic  design  shock  requirements  of  M1L-STD-810C,  figure  516.2-1 
are  recommended.  Terminal-peak  sawtooth  shock  pulses  of  2C  g  peak  and 
1 1 -mi  1 1 i second  duration  are  suggested.  In  addition,  reasonable  require¬ 
ments  for  crash  safety  and  bench  handling  should  be  specified. 
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The  temperature-altitude  environments  of  MIL-E-5400,  Class  2  are 
recommended.  They  include  the  design  requirement  to  operate  in  a  con¬ 
tinuous  temperature  ambient  of  -54  to  +71°C  and  a  30-minute  intermittent 
operation  at  +95°C.  In  addition,  the  altitude  range  is  from  sea  level 
to  70,000  feet.  This  requirement  will  allow  for  the  needed  installation 
flexibility  on  A/F/T  aircraft.  Both  the  CSMU  and  the  DPU  are  capable  of 
reliable  performance  in  this  environment  without  employing  a  cooling  fan 
or  other  added  cooling  aids. 

In  addition  to  these  three,  the  full  complement  of  normal  qualifica¬ 
tion  design  requirement!-  for  airborne  electronics  should  be  employed. 

These  requirements  include  altitude,  high  temperature,  low  temperature, 
temperature  shock,  humidity,  fungus,  salt  fog,  dust,  explosive  atmosphere, 
acceleration,  and  temperature-humidity-altitude.  Standard  and  proven 
design  procedures  and  manufacturing  processing  will  assure  a  quality 
design  of  the  DPU  and  CSMU,  which  will  be  capable  of  reliable  perfor¬ 
mance  at  these  qualification  test  levels. 

The  DPU  will  have  a  bolt-on  front  panel  with  military  standard 
connectors.  The  unit  retention  hardware  will  include  a  rear  wedge 
retainer  and  two  front  panel  ARINC-style  hold-down  hooks,  facilitating  a 
quick  disconnect  and  removable  feature.  Configurations  I  and  III  will 
require  an  additional  printed  circuit  board.  The  Configuration  II 
descriptions,  below,  will  be  presented  within  parentheses.  The  chassis 
dimensions  of  the  DPU  will  be  7.38  inches  x  5.75  inches  x  5.00  inches 
(7.38  inches  x  5.35  inches  x  5.00  inches).  The  envelope  volume  will  be 
212  (197)  cubic  inches  and  weight  of  8.4  (7.6)  lbm.  is  estimated.  The 
unit  will  contain  seven  (six)  printed  circuit  boards.  Two  power  supply 
assemblies  and  a  power  transformer  will  be  required,  which  account  for 
nearly  2  pounds  of  the  total  weight.  A  design  concept  DPU  sketch  is 
shown  in  figure  55. 

The  CSMU  design  concept  sketch  is  shown  in  frgure  17.  The  CSMU 
.050-inch-thick  aluminum  dust  cover  will  be  removable  by  extracting  four 
screws,  while  an  additional  two  screws  will  remove  the  armor  cover. 

Five  standoffs  and  screws  mount  the  timing  and  control  electronics  b >ard 
to  the  armor  cover  and  two  screws  attach  the  external  connector  to  t  le 
printed  circuit  board.  The  CPM  and  circuit  board  assemblies  will  be 
easily  tested  and  repairable.  The  molded  Min-K  insulation  consists  of 
two  half  shells,  which  mate  with  an  offset  interlocking  seam,  forming  a 
close-tolerance,  high-thermal-resistant  interface.  The  CPM  will  be 
completely  enclosed  within  . 8- inch-thi ck  insulation.  The  molded  insula¬ 
tion  seam  will  be  designed  with  a  passage  in  which  the  interconnect  will 
be  contained  as  it  passes  through  the  insulation.  Molded  Min-K  half 
shells  have  been  successfully  employed  in  similar  applications,  pro¬ 
tecting  electronics  on  manned  spacecraft,  aircraft,  and  other  high- 
temperature  applications. 
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Figure  17.  CSMU  Design  Concept  Sketch 


The  CSMU  will  be  equipped  with  one  shell-size-12  military  standard 
connector.  The  unit  will  be  installed  in  the  aircraft  with  four  belts. 
Configurations  I  and  III  will  require  8K  x  16  bits  of  crash-protected 
memory,  while  Configuration  II  is  a  smaller  unit  with  only  4k  x  16  bits. 

The  CSMU  is  3.9b  inches  x  3.80  inches  x  2.80  inches  (3.80  inches  x  3.30 
inches  x  2.80  inches),  for  a  total  volume  of  42  (35)  cubic  inches,  and 
the  CSMU  will  weigh  2.8  (2.4)  lbm.  As  stated  earlier,  the  armor  will  be 
either  . 153-inch- thick  steel  or  .180-inch-thick  titanium. 

b.  MNOS  high-temperature  memory  retention.  MNOS  memory 
chips,  like  all  IC  memory  technologies,  are  susceptible  to  high  tempera¬ 
ture  damage.  The  data  retention  phenomena  is  related  to  the  temperature 
exposure  level  as  well  as  the  time  period  at  that  level. 

The  physical  phenomenon  of  this  time/temperature  memory  retention 
damage  is  that  a  stored  "0"  is  entered  as  a  zero  or  low-voltage  potential 
across  a  nitride-oxide  interface.  A  stored  "1"  is  entered  as  a  higher 
potential.  At  low  and  moderate  temperatures,  the  entered  voltage  poten¬ 
tials  are  maintained  for  a  very  long  time  periou,  making  MNOS  a  nonvolatile 
memory.  At  higher  temperatures,  two  voltage  loss  mechanisms  called 
"tunneling  and  thermal  excitation  of  stored  charge"  become  significant, 
and  memory  retention  is  affected.  An  excellent  study  report  on  this 
subject  was  presented  to  the  IEEE  in  1 9 7 9 1 1  and  the  time/temperature 
results  are  summarized  in  figure  18.  As  shown,  memory  retention  time 
versus  temperature  is  a  straight  line  on  log- log  paper  with  a  slope  of 
-.736  dB/decade.  This  time/ temperature  data  is  for  a  typical  MNOS 
memory  chip  and  not  for  our  proposed  MNOS  EE-PROM,  which  is  a  much  more 
current  design  Every  indication  is  that  as  MNOS  technology  m.Kjres, 
the  maximum  number  of  read  cycles  and  the  time/ tempera  lure  performance 
will  only  improve 

The  data  shows  that  the  memory  can  take  1  minute  of  exposure  at 
350°C,  1  hour  at  258°C,  l  day  at  200°C,  and  1  month  at  lb0°C.  The 
exposure  during  a  tire  test  will  be  a  time/temperature  profile,  not  a 
single  temperature  level  for  a  given  time.  To  account  for  this,  Miner's 
Law  of  Cumulative  Fatigue  Damage  is  utilized.  This  basically  takes  a 
summation  of  the  damage  at  each  temperature  lev  >1  encountered,  by  summing 
the  ratios  of  time  spent  at  a  given  temperature  to  the  memory  retention 
time  at  that  same  temperature.  If  the  sum  of  the  ratios  is  less  than 
1.0,  the  memory  is  retained;  if  greater  than  1.0,  the  memory  was  lost. 

As  an  added  factor  of  safety,  0.7  is  taken  as  the  pass/fail  criterion, 
in  accordance  with  Miner's  Law.  In  equation  form,  the  p  .«/  fail 
criterion  is  calculated  as  follows: 


^Kjell  0.  Jeppson  and  Christer  M.  Svensson.  "Retention  Testing  of 
MNOS  LSI  Memories",  IEEE  Journal  of  Solid  State  Circuits ,  Vol  .  SC-14, 
No.  4,  August  1979,  p  723-9. 
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Memory  Retention  Time  (minutes) 


where 
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x 

N  =  I  - —  ^  0.7  for  acceptable  data  retention 
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N 
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x 


t 
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damage  life  factor  (unitless) 

time  exposure  at  the  temperature  of  x°C 
(minutes) 

memory  retention  time  at  x°C, 


The  damage  life  factor  of  the  proposed  design  when  subjected  to  the 
750°C,  15-minute  duration  oven  test  is  N=0.30  (a  factor  of  safety  of 
.7/. 3  =  2.33). 


c.  CSMU  fire  protection  worthiness/thermal  evaluation.  The 
fire  protection  worthiness  and  thermal  evaluation  of  our  proposed  CSMU 
design  was  accomplished  using  a  finite  differencing  transient  thermal 
analysis.  The  analysis  was  performed  using  an  IBM-370  computer.  Output 
time/temperature  profile  Calcomp  plots  were  generated  displaying  the 
results  of  each  run. 


An  eight-node  thermal  model  of  tne  CSMU  was  utilized.  Initial 
temperatures,  boundary  conditions,  flame  heat  flux,  thermal  capacitance 
of  each  node,  and  the  thermal  resistances  between  adjacent  nodes  were 
calculated  and  input  for  each  thermal  run.  The  eight  node's  used  for 
each  run  were  as  follows: 


Node  number  1 
Node  number  2 
Node  number  3 
Node  number  A 
Node  number  5 
Node  number  6 
Node  number  7 
Node  number  8 


CPM  node 

Inside  .3-inch  thickness  of  Min-K  insulation 
Middle  .2-inch  thickness  of  Min-K  insulation 
Outside  .3-inch  thickness  of  Min-K  insulation 
Armor  enclosure  (9Ni-4Co  steel,  .125  'nch  thick) 
External  CSMU  surface  temperature 
Flame  node  or  oven  air  temperature 
Surrounding  ambient  or  oven  wall  temperature 
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In  each  run,  the  8k  x  16-bit  CSMU  was  analyzed,  since  it  is  worst 
case;  the  smaller  CSMU  will  exhibit  better  thermal  performance.  Each 
run  included  a  steady  state  solution  to  arrive  at  initial  temperatures, 
followed  by  either  a  simulated  oven  or  flame  exposure  period.  It  was 
concluded  by  a  sufficient  cool-down  period  so  that  the  CPM  had  time  to 
reach  its  maximum  temperature  and  begin  to  cool  off. 

Tables  20  and  21  summarize  the  complete  set  of  thermal  runs  in  the 
chronological  order  in  which  they  were  made.  Shown  are  modeled  input 
properties,  the  significant  results,  and  comments.  Runs  number  1,  2,  3, 
and  4  modeled  the  CSMU  completely  enveloped  by  a  large  JP-4  fireball. 

The  proposed  CSMU  cannot  survive  10  minutes  of  exposure  to  this  environ¬ 
ment.  However,  3  to  6  minutes  would  be  survivable.  Run  number  2  was 
modeled  with  intumescent  coating  outside  the  armor.  Runs  number  3  and  4 
varied  the  thickness  of  Mir.-K  insulation  to  prove  that  .8  inches  was  a 
near  optimum  thickness.  Very  little  thermal  performance  is  gained  by 
increasing  the  thickness  above  .8  inches.  Run  number  5  decreased  the 
size  of  the  JP-4  fire  to  a  3.6-foot  diameter  flame  and  the  CSMU  survived 
10  minutes  of  exposure  to  this  environment. 

In  runs  number  6,  7,  and  8,  flame  environments  in  accordance  with 
TSO  C51A  were  simulated,  to  show  how  benign  these  environments  are.  In 
run  number  7,  the  flame  temperature  was  raised  from  1100°C  to  1343°C, 
while  in  number  8,  100%  envelopment  was  modeled.  In  run  number  9,  the 
flame  was  increased  so  that  aluminum  present  would  undergo  significant 
melting.  Run  number  9  showed  that  Min-K-1301  was  entirely  adequate, 
with  a  maximum  service  temperature  of  1300°F  (705°C).  In  the  remaining 
analyses,  Min-K-1301  was  modeled.  Min-K-1301  is  a  slightly  superior 
insulation  with  lower  thermal  conductivity  and  better  compression  strength 
than  Min-K-2000.  The  vendor  states  that  its  transient  exposure  service 
.emperature  is  much  higher  than  1300°F.  Run  number  10  showed  that  -1301 
insulation  lowers  the  CPM  maximum  temperature  9°C,  while  lowering  the 
damage  life  factor  from  .36  to  .28. 

Runs  number  11  through  number  14  modeled  a  simulated  oven  test  in 
order  to  recommend  a  test  level  equivalent  to  that  encountered  during 
the  flame  exposure  in  run  number  10.  Room  temperature  initial  conditions 
were  chosen  for  ease  cf  testing.  It  will  take  less  time  to  stabilize  at 
room  tempeiature  prior  to  the  oven  exposure,  and  a  second  oven  at  7 1 0 C 
will  not  be  required.  In  run  number  14,  the  thermal  capacitance  of  the 
armor  was  doubled  in  order  to  observe  its  impact. 


Table  20.  Summary  of  CSMU  Thermal  Analyses  in  a  JP-4  Flame  Environment 


In  all  14  runs,  the  emissivity  of  the  CSMU  was  assumed  to  be  .90, 
because  of  the  soot  formation  mentioned  above.  Convection  heat  transfer 
coefficients  were  calculated  as  accurately  as  possible.  The  interconnect 
conductivity  was  modeled:  however,  the  insulation  seam  effects  were  not 
included.  In  both  the  oven  and  flame  analyses,  .3-minute  transition 
periods  were  modeled  for  flame  ignition  and  extinguishment  or  for  transfer 
into  and  out  of  the  oven. 

Figures  19  and  20  show  the  computer-generated  Calcomp  plots  of  all 
eight  nodes  in  runs  number  6  and  10,  respectively.  The  over  and  under 
shoots  shown  for  node  number  7  are  caused  by  a  second-order  curve-fitting 
routine.  Notice  that  the  y-axis  is  scaled  from  0  to  1400°C,  while  the 
x-axis  is  scaled  from  0  to  50  minutes. 

Figure  21  is  a  Calcomp  plot  of  only  node  number  1,  the  CPM  module 
temperature  for  runs  number  1,  3,  4,  5,  6,  10,  13,  and  14.  They  are 
presented  for  ease  of  comparison  between  the  resultant  performances, 
with  more  resolution  of  the  temperature  scale  (0  to  350°C). 

The  recommended  CSMU  will  exhibit  excellent  survivability  in  the 
post-crash-fire  environments  of  A/F/T  aircraft.  The  chosen  Min-K  insula¬ 
tion  is  the  best  non-vacuum,  high-temperature  insulation  on  the  market. 
Firm  quotes  have  been  received  from  Johns-Manville  for  unit  prices, 
ranging  from  $72  in  high  quantities  to  $92  in  moderate  quantities,  for 
both  pieces.  This  price  does  not  include  modest  tooling  and  set-up 
charges  and  it  was  for  an  initial  insulation  design.  However,  the  costs 
are  representative. 

d.  CSMU  armor  enclosure  design.  The  base  of  the  armor  enclo¬ 
sure  was  designed  so  that  it  could  be  cast  in  high  volume  production  and 
yet  machined  and  welded  in  the  initial  low  volume  phase.  As  shown  by 
analysis  above,  the  enclosure  will  pass  the  penetration  testing.  The 
armor  cover  is  a  simple  flat  plate  which  will  be  machined  in  most  produc- 
t i on  volumes . 

The  cover  keying  blocks,  shown  in  figure  17,  serve  two  purposes. 

First  of  all,  one  of  the  two  blocks  protects  the  CPM  interconnect  as  it 
passes  out  of  the  armor  enclosure  and  into  the  dust  cover-protected 
chassis  volume.  Secondly,  the  keying  blocks  support  the  armor  cover 
against  any  shear  forces  attempting  to  dislodge  the  cover.  The  six 
screws  attaching  the  armor  cover  are  sized  only  to  resist  the  modest 
tensile  loads  which  will  occur  during  a  crash  environment.  The  large 
compressive  and  shearing  loads  will  be  resisted  by  the  top  edge  of  the 
base  and  the  keying  blocks,  respectively. 
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Figure  20.  CSMU  Severe  Flane  Test  (.Kun  No.  10) 


SUMMARY  OF  CPM  THERMAL  PERFORMANCE  (RUNS  «1 ,3,M.5,6. 10, 13, 414) 


I ME  (MINUTES  **  CPM  TIME/TEMPERATURE  PROFILES  ** 


The  four  mounting  feet  and  attachment  bolts  are  not  intended  to 
keep  the  CSMU  attached  to  the  aircraft  structure  following  a  severe 
crash.  There  is  no  need  for  it  to  remain  attached  to  the  structure, 
which  itself  is  undergoing  major  mechanical  damage,  and  fracture  into 
many  small  pieces.  The  survivability  of  the  CSMU  will  be  enhanced  as 
impact  durations  are  shortened  and  the  kinetic  energy  (!sMV2)  will  be 
lower,  assuming  identical  velocities  but  lower  projectile  mass.  The 
CSMU  armor  enclosure  will  exhibit  adequate  mechanical  protection  for  the 
CPM  and  the  Min-K  insulation. 

3, 1.3.6  Crash-survivability  prediction  -  A  prediction  of  the 
survivability  of  the  CPM  data,  based  on  USAF  mishap  data,  is  an  extremely 
challenging  task.  Regardless  of  the  conclusions,  they  can  be  easily 
criticized  and  refuted.  The  very  nature  of  the  problem  allows  for  the 
utilization  of  little  but  one's  best  engineering  judgement.  Assuming 
that  the  CSMU  will  surpass  the  test  requirements  recommended  in  3. 1.3.2, 
the  following  A/F/T  crash  survivability  rates  are  predicted. 

a.  Mechanical  damage.  With  the  CSMU  mounted  in  the  wing  or 
tail  cone  areas,  total  mechanical  damage  will  be  incurred  only  11  to  13 
percent  of  the  time;  major  mechanical  damage  only  9  to  16  percent  of  the 
time  (based  on  the  35  A-10,  F-15,  and  F-16  accidents  reported  in  table  16). 
Our  CPM  should  survive  intact,  100  percent  of  the  major  and  at  least  80 
percent  of  the  total  mechanical  damage  crashes.  This  gives  a  non-surviva¬ 
bility  rate  of  only  2.2  to  2.6  percent,  in  which  the  CPM  did  not  survive 
intact.  Of  this  2.2  to  2.6  percent,  an  additional  retrieval  effort  will 
allow  the  data  to  be  read  out  nearly  100  percent  of  the  time.  Fly  lead 
damage,  and  possibly  silicone  memory  die  damage,  may  reduce  this  lower 
level  data  retrieval  success  rate  to  90  percent.  Therefore,  the  data 
failure  rate  will  be  at  most  .3  percent. 

b.  Fire  damage.  With  the  CSMU  mounted  in  the  wings  or  tail 
cone,  total  fire  damage  occurs  zero  percent  of  the  time  and  major  fire 
damage  A  to  9  percent.  Since  the  CSMU  can  survive  a  15-minute  test  in 
which  significant  or  total  aluminum  meltdown  will  occur,  99.9  percent 
survivability  is  predicted 

c.  Combination  of  mechanical  and  fire  damage.  The  mishap 
data  in  appendix  D,  where  actual  accident  files  were  reviewed,  indicates 
that  severe  mishaps  initiate  both  severe  mechanical  and  severe  fire 
damage  sequentially.  Therefore,  if  t  e  CSMU  is  only  80  percent  survivable 
when  total  mechanical  and  major  fire  d  mage  occur,  at  most  the  failure 
rate  will  be  1.8  percent  (20  percent  times  9  percent,  the  maximum  rate 

of  major  fire  damage). 

The  crash  survivability  requirements  will  guarantee  passage  of  most 
of  these  combined  environments. 
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d.  Other.  There  will,  without  a  doubt,  be  CPM  data  survival 
failures  which  cannot  be  attributed  to  fire  and  mechanical  damage.  The 
largest  share  of  these  could  possibly  be  due  to  a  malfunctioning  CSFDR 
system  or  a  bad  sensor  signal  received  by  the  system,  caused  by  a  normal 
in-fli;>ht  failure.  However,  if  the  system  operability  is  mandatory  as  a 
GO/NO-GO  pre-flight  requisite,  this  failure  mode  should  be  less  than  .5 
percent.  Another  cause  of  failure  could  be  an  abnormally  weak  memory 
chip  which  goes  undetected  and  fails  in  either  the  mechanical  or  the 
fire  damage  environments.  This  would  result  in  the  loss  of  a  portion  of 
the  CPM  data.  Still  another  possibility  is  that  the  data  completely 
survives  the  crash  and  then  somehow  suffers  abuse  prior  to  retrieval. 
However,  assuming  that  proper  Air  Force  and  supplier  procedures  are  in 
effect,  all  of  these  failure  modes  should  not  amount  to  a  1  percent 
failure  rate. 

e  Conclusions.  The  failure  rates  listed  above  are:  mechanical 
damage  .3  percent,  fire  damage  .1  percent,  fire  and  mechanical  damage 
1.8  percent,  and  other  damage  1  percent,  for  a  total  failure  rate  of  3.2 
percent.  With  this  in  mind,  it  would  seem  safe  to  guarantee  a  better 
than  96  percent  survival  rate  and  to  expect  the  actual  survival  rate  to 
approach  98  percent.  On  the  other  hand,  if  the  CSFDR  system  were  to  be 
designed  to  meet  only  the  TSO  C5!A  requirements,  an  80  to  85  percent 
survivability,  at  best,  could  be  expected. 

3.2  Technical  approach 

3.2.1  Tri-service  standardization  investigation  -  The  primary 
purpose  of  this  section  is  to  make  a  specific  recommendation  concerning 
the  potential  for  standardization  among  Air  Force,  Navy,  and  Army  appli¬ 
cations.  In  order  to  complete  this  task,  conflicting  requirements,  if 
any  exist,  must  be  identified  and  analyzed.  The  primary  vehicles  for 
identifying  Navy  and  Army  requirements  are  the  ULAIDS  (Universal  Locator 
Airborne  Integrated  Data  System)  and  AIRS  (Accident  Information  Retrieval 
System)  programs,  respectively.  Additional  data  was  obtained  via  question¬ 
naires  directed  to  Navy  and  Army  personnel  concerned  with  military 
aviation  safety. 

3. 2. 1.1  ULAIDS  program  -  This  program  attacks  crash-survivable 
flight  data  recording  from  the  Navy  viewpoint.  Its’  system  includes  two 
recorder  , :  1 )  an  AHdR  (Aircraft  Health  Monitoring  Recorder)  and  2)  a 
FTR/UL  (Flight  Incident  Recorder/Universal  Locator)  package.  Currently, 

. ,e  AHMR  is  a  tape  unit.  The  FIR  is  being  approached  from  both  the  tape 
and  solid-state  electronic  memory  technologies.  Additionally,  the 
ULAIDS  system  includes  the  following  equipment: 
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•  Two  Signal  Acquisition  and  Conditioning  Terminals 

•  Master  Monitor  Display 

•  Data  Entry  Panel 

•  Two  Multiplex  Terminal  Units 

•  Interconnecting  Cables 

Production  targets  for  total  system  weight,  size,  and  power  are 
89  pounds,  5121  cubic  inches  and  358  watts,  respectively. 

Additionally,  a  maximum  of  374  sensor/parameters  can  be  recorded. 

Two  unique  features  related  to  ULAIDS  are  1)  the  FIR/UL  is  an  ejectable 
package,  and  2)  one  of  the  parameters  required  is  voice  (audio). 

3.2. 1.2  AIRS  program  -  This  program  attacks  crash-survivable 
flight  data  recording  from  the  Army  viewpoint.  A  solid-state,  non- 
ejectable  recorder  is  used  for  recording,  in  which  the  actual  data 
module  is  designed  to  survive  requirements  in  excess  of  TS0-C51a. 
Production  targets  for  total  system  weight,  size,  and  power  are 

7.62  pounds,  190.5  cubic  inches,  and  25  watts.  Also,  a  capability  of 
multiplexing  18  analog  and  18  discrete  signals  exists  within  the  AIRS 
recording  unit.  A  unique  feature  of  the  AIRS  design  is  its  capability 
of  surviving  impacts  up  to  150  gs  for  a  duration  of  10  milliseconds. 

This  feature  permits  acceleration  of  the  crew-space  area  to  be  measured 
during  impact,  and  consequently,  design  improvements  for  crew  safety  can 
be  made.  However,  an  additional  accelerometer  package  is  required  to 
provide  this  capability  s'  ce  most  aircraft  are  not  equipped  with  accel¬ 
erometers  that  have  the  _>0-g  range. 

3 . 2 . 1 . 3  Tri-service  requirements 

a.  Flight  parameters.  Navy  and  Army  parameter  lists  were 
reviewed.  These  lists  included  the  proposed  F-18,  A-7E,  AF/ASH-20, 

NPS-1,  NPS-2,  ULAIDS,  minimum  AIRS,  intermediate  AIRS,  and  recommended 
AIRS.  The  USAF  recommended  CSFDR  can  handle  all  of  the  parameters 
reviewed  with  two  exceptions. 

(1)  Audio  as  required  by  the  ULAIDS  list. 

(2)  Three  axes  of  impact  gs  in  the  ±  150-g  range  for  the 

AIRS  lists. 

Neither  of  these  two  parameters  (audio  or  impact  gs)  are  recommended 
for  the  USAF  Mst.  This  does  not  imply  that  these  two  parameters  are 
not  useful  in  their  intended  applications.  However,  keeping  in  mind 
that  the  CSFDR  system  primary  design  constraints  for  the  A/F/T  problem 
include  size,  weight,  and  LCC,  these  additional  parameters  are  not 
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recommended  for  the  USAF.  The  audio  parameter  has  a  severe  impact  on 
the  size,  weight,  and  cost  due  to  the  separate  audio  conditioning  unit 
and  expanded  memory  required  (5.5  million  bits  to  store  15  minutes  of 
audio).  The  desire  to  record  impact  accelerations  requires  that  a 
separate  accelerometer  package  be  located  near  the  cockpit  area,  and 
that  the  recorder  electronics  remain  functional  through  the  first  ±  150  gs 
of  impact.  This  requirement  also  adversely  affects  size,  weight,  and 
LCC  and  appears  to  be  of  limited  value  to  the  A/F/T  problem. 

b.  Installation.  The  Navy-  and  Army-required  installations 
do  not  pose  a  problem  to  the  recommended  CSFDR  design.  The  Navy  desires 
an  ejectaLle  memory  pack  which  has  the  added  capability  of  floating 
after  aircraft  impact  with  water.  It  is  felt  that  this  approach  is  the 
best  one  for  the  Navy  because  of  the  high  percentage  of  accidents  which 
occur  at  sea.  Since  the  recommended  CSFDR  system  design  has  a  separate 
memory  pack  (CSMU),  it  is  a  relatively  simple  task  to  package  the  CSMU 

on  an  ejectable  air  foil  and  provide  the  Navy  with  this  needed  capability. 

The  Army  does  not  require  an  ejectable  memory  pack  and  since  the 
impact  accelerations  of  an  Army  helicopter  are  quite  low  when  compared 
to  those  of  an  A/F/T  aircraft,  no  problem  is  envisioned  for  CSFDR  instal¬ 
lations  for  Army  applications. 

c.  Crash  survivabi lity  and  packaging.  The  A/F/T  crash-survival 
requirements  are  the  most  severe  in  the  entire  avionics  industry.  This 

is  due  to  the  smaller  overall  dimensions  of  the  aircraft,  and  the  severity 
of  high  velocity/high  impact  angle  crashes.  In  the  case  of  the  Navy, 
where  an  ejectable  pack  is  required,  the  crash  environment  is  relatively 
benign  in  terms  of  impact,  penetration,  static  crush,  and  fire.  Obviously 
the  water  immersion  requirement  is  very  important,  however,  the  proposed 
CSFDR  system  meets  the  Navy  water  immersion  requirement. 

In  the  case  of  the  Army,  the  impact,  penetration,  and  static  crush 
requirements  are  typical  of  commercial  airline  requirements.  However, 
because  of  the  lower  velocities  and  unique  construction  of  Army  helicop- 
tors,  the  probability  of  the  CSMU  remaining  in  the  post-crash  fire  is 
increased  somewhat.  This  potential  problem  can  be  offset  by  locating 
the  CSMU  away  from  the  fuel  tank  areas.  The  Army  water  immersion  require¬ 
ment  of  four  weeks  is  compatible  with  the  equivalent  recommended  CSFDR 
system  requirement. 

Thus,  in  summary,  the  Navy  and  Army  survivability  and  packaging 
requirements  do  not  pose  a  problem  to  the  CSFDR  system. 
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d.  Crash-protected  memory  required.  The  CPMs  for  Configur¬ 
ations  I  and  II  are  8K  x  16  bits  and  4K  x  16  bits,  respectively.  The 
recommended  memories  for  the  ULAIDS  and  AIRS  recorders  are  approximately 
6,000,000  bits  and  32,000  bits,  respectively.  If  the  requirement  to 
record  audio  is  removed  from  the  Navy  system,  only  500,000  bits  ai 
required,  and  if  a  bit  compression  ratio  of  10/1  can  be  achieved  for  the 
Navy  data,  a  CPM  of  50,000  bits  would  be  sufficient.  Therefore,  both 
the  Army  and  Navy  requirements  could  be  satisfied  by  the  Configuration  II 
CPM  of  4K  x  16  bits  (65,536  bits),  even  though  these  systems  are  con¬ 
figured  to  nominally  retain  the  last  30  minutes  of  data  (and  in  the  case 
of  the  Navy,  15  minutes  of  audio). 

Thus,  the  projected  USAF  CSFDR  system  crash-protected  memory  ranges 
are  adequate  for  the  Army  and  Navy  applications. 

Note:  It  must  be  remembered  that  not  all  Navy  paramter  lists 

include  audio,  and  therefore,  audio  is  net  viewed  as  a  firm  requirement, 
even  though  it  is  a  highly  desirable  one  for  the  Navy. 

e.  Data/conversion  data  processing/data  compression.  The 
data  conversion  functions  are  extremely  similar  for  all  three  services, 
even  though  the  actual  parameters  may  be  unique.  For  example,  the  Navy 
FIR  list  includes  arresting  hook  position  as  a  parameter.  This  parameter 
is  sensed  as  a  discrete.  The  CSFDR  system  DPU  samples  and  converts 
discretes  regardless  of  what  the  discretes  represent.  Similarly,  the 
Army  lists  include  rotor  RPM  as  a  parameter.  This  parameter  is  sensed 

as  a  frequency  input.  The  CSFDR  system  DPU  samples  and  converts  freq¬ 
uencies  to  digital  words  regardless  of  what  the  frequencies  represent. 

The  CSFDR  system  DPU  data  conversion  modules  contain  the  following 
types  of  capabilities'. 

•  Synchro/ resolver/LVDT  to  digital 

•  DC  to  digital 

•  AC  to  digital 

•  Frequency  to  digital 

•  Discrete  to  digital 

•  Aircraft  MUX  Bus  Interface  (standard  1553,  and  non-standard) 
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The  Army  system,  for  helicopters,  requires  only  18  analog  and 
18  discrete  inputs.  This  is  well  within  the  CSFDR  system  capability. 

Also,  the  Navy  system  requires  a  typical  signal  capacity  of  72  discretes 
and  approximately  71  analog  inputs.  The  multiplexing  capability  designed 
into  the  CSFDR  system  is  also  adequate  for  these  conversions. 

Also,  of  extreme  importance,  is  the  fact  that  all  three  services 
are  going  to  the  MIL-STD-1553  aircraft  MUX  bus  architectures.  Thus,  the 
MUX  bus  interface  of  the  CSFDR  system  is  directly  applicable  to  the 
tri-service  problem,  and  as  modern  aircraft  approach  an  all-digital 
type,  the  aircraft  integration  of  a  tri-service  CSFDR  system  will  become 
a  relatively  easy  task. 

The  actual  data  processing/data  compression  functions  of  the  CSFDR 
system  are  very  comparable  to  those  that  would  be  required  for  the  Navy 
recording  system.  For  example,  the  F-15  throughput  and  compression 
ratios  would  be  very  similar  to  those  of  the  F-18.  Also,  the  dp/dc 
functions  of  the  CSFDR  system  are  more  than  adequate  for  the  Army  system 
since  the  number  of  signals  and  resulting  data  rates  are  much  lower.  It 
should  be  noted,  however,  that  parameter  labels,  limits,  and  aperture 
sizes  may  vary  within  the  tri-service  applications  and  threfore  some 
minor  software  changes  will  be  required.  However,  it  must  be  emphasized 
that  the  CSFDP  system  is  programmable  and  reprogramming  is  not  a  problem. 
(The  CSFDR  system  must  be  programmable  even  for  the  USAF  programs  because, 
as  aircraft  age,  it  may  become  desirable  to  reprioritize  the  parameters 
and  add  or  delete  parameters  as  desired  by  accident  investigators.) 

Thus,  in  summary,  the  data  conversion,  data  processing,  and  data 
compression  routines  are  adaptable  to  the  tri-service  problem. 

f.  Ground  readout  facility  and  associated  software.  The 
ground  readout  facility  and  associated  software  should  reside  at  a 
separate  location  for  each  service.  Since  DOD  5000.31  specifies  Fortran  IV 
as  an  acceptable  language  for  ground-based  machines  for  all  three  services, 
it  is  recommended  that  this  language  be  used  for  all  three  services  to 
assure  maximum  compatibility. 

However,  a  tri-service  readout  facility  is  not  recommended.  The 
NTSB  is  not  currently  staffed  or  equipped  to  handle  a  tri-service  readout 
capability.  Additionally,  their  definition  of  transportation  does  not 
include  military  operations.  The  Navy's  North  Island  facility  is  planned 
for  Navy  readouts,  and  this  facility  is  not  recommended  for  the  USAF. 

In  summary,  we  feel  that  each  service  should  maintain  its  own 
readout  facility  because  of  the  frequency/demand  relationship  and  indepen¬ 
dent  locations  of  accident/  mishap  data  which  are  already  in  existence. 
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g.  Security  protection  of  data.  Security  protection  is  discussed 
in  3.2.5  for  the  USAF.  The  Navy  applications  require  dwuJ  encryption 
standards.  We  also  recommend  these  standards  for  the  Army  applications, 
although  they  are  not  currently  required.  Once  the  security  protection 
features  have  been  integrated  into  the  CSFDR  system,  they  are  also 
directly  applicable  to  the  Navy  and  Army  problems.  Because  this  feature 

is  easily  incorporated  into  the  recorder  systems,  it  is  recommended  for 
all  three  services. 

h.  Military  directives.  Appendix  F  shows  the  Cross-Reference 
of  Military  Directives  Related  to  Aircraft  Accident  Safety  Investiga¬ 
tions  and  includes  the  NTSB  and  Coast-Guard  directives.  Although  the 
definitions,  procedures,  methods  of  recovering  data,  etc.  vary  from 
service  to  service,  no  conflicting  requirements  were  found  which  could 
potentially  arise  out  of  the  implementation  of  these  directives  insofar 
as  the  recorder  and  use  of  its  data  were  concerned.  In  fact,  in  the 
case  of  a  mishap  involving  military  aircraft  from  two  or  more  services, 

a  common  recorder  would  be  beneficial  to  the  joint  mishap  board  since 
the  resulting  formats  of  data  presentation  would  be  common. 

i.  Expanded  recording  function.  In  terms  of  conversion, 
processing,  and  compression,  the  DPU  can  handle  the  expanded  recording 
functions  of  ASIP,  TEH,  and  FC  monitoring  for  the  USAF  applications. 
However,  separate  solid-state,  non-survivable  memories  were  recommended 
for  these  functions.  This  separation  of  the  non-survivable  memory  is 
recommended  for  the  USAF;  however,  it  is  required  for  the  Navy  AHMR 
function  since  the  Navy  policy  is  to  separate  the  "maintenance  data" 
from  the  flight  incident  data.  A  common  processor,  however,  can  be  used 
for  both  functions. 

Expanded  recording  functions  are  not  required  for  the  Army  recorder, 
however,  if  they  become  a  requirement  in  the  future  it  is  recommended 
that  a  separate,  non-survivable  memory  package  be  used  for  these  functions. 

Thus,  the  approach  taken  for  the  USAF  CSFDR  program  is  not  in 
conflict  with  the  expanded  recording  requirements  of  the  other  services. 

j.  Large-scale  standardization.  Large-scale  standardization 
is  desired  by  all  three  services.  A  classic  example  is  the  standardiza¬ 
tion  of  the  Navy  FIR/UL  for  the  P-3  and  A-7  aircraft.  The  approach 
recommended  for  the  USAF  CSFDR  system  does  not  present  a  conflict  in 
terms  of  large-scale  standardization  for  other  services. 
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k.  Summary  of  tri-service  standardization  investigation. 

Table  22  shows  the  areas  of  investigation  for  tri-service  standardiza¬ 
tion  along  with  the  recommended  USAF  CSFDR  approach.  Areas,  in  which 
the  recommended  approach  agrees  with  or  conflicts  with  Army  and  Navy 
concepts,  are  also  shown  in  the  table. 

3. 2. 1.4  Conclusions  of  tri-service  standardization  study  -  The 
design  approach  recommended  for  the  USAF  CSFDR  system  permits  a  tri-service 
standard  recorder  to  be  produced  if  potentially  conflicting  requirements 
are  resolved.  The  first  potentially  conflicting  requirement  is  that  of 
recording  audio  information.  The  desire  to  record  audio  has  a  negative 
impact  on  volume,  weight,  and  LCC  of  the  installed  recording  system. 
Additionally  the  initial  area  of  crash-survivable  memory  is  adversely 
affected  and  the  required  memory  for  compressed  audio  is  approximately 
two  orders  of  magnitude  over  and  above  that  required  for  compressed 
data.  The  desire  to  record  audio  also  implies  microphone  station  inte¬ 
gration  and  a  separate  audio  conditioning  unit.  However,  this  discussion 
does  not  imply  that  audio  data  is  not  useful  in  an  accident  investigation. 
Moreover,  the  desire  to  record  audio  in  the  Navy  systems  is  not  a  firm 
lequirement  at  this  time.  This  fact  is  evident  in  the  recent  parameter 
list  for  the  F-18.  Thus,  on  a  temporary  basis,  until  the  state-of-the 
art  for  digitizing  audio  and  related  memory  densities  each  improve,  we 
recommend  that  audio  not  be  included  as  a  firm  requirement  for  tri-service 
standardization  involving  A/F/T  aircraft. 

The  second  potentially  conflicting  requirement  is  that  of  recording 
impact  accelerations  during  a  catastrophic  mishap.  Although  such  data 
can  be  of  great  value  in  designing  the  crew  space  area  for  low  velocity 
aircraft,  the  adverse  effects  on  weight,  size,  and  LCC  of  carrying  this 
capability  through  to  all  production  units  does  not  seem  realistic. 
Therefore,  we  do  not  view  this  capability  as  a  requirement  for  production 
units  in  any  of  the  services. 

Therefore  tri-service  standardization  is  feasible  and  compatible 
with  the  recommended  USAF  CSFDR  system  approach  if  audio  and  impact 
recording  are  not  firm  requirements.  The  Navy  desire  for  "deployable 
and  floatable"  memory  packs  is  justified  and  does  not  present  a  con¬ 
flicting  requirement  to  the  recommended  approach  because  the  CSMU  is  a 
separate  module  and  may  be  packaged  on  an  ejectable  air  foil. 

The  LCC  of  a  tri-service  standardization  program  for  crash- 
survivable  flight  data  recording  would  be  less  than  three  individual 
programs  (one  for  each  service).  For  a  tri-service  program,  resulting 
in  production  quantities  of  30,000  recording  systems,  the  LCC  cost 
savings  of  50%  is  estimated  based  upon  similarity  to  existing  programs 
within  D0D.  However,  once  the  decision  has  been  made  to  develop  a 
tri-service  standard,  provisions  should  be  made  for  a  primary  and  a 
secondary  source  from  the  very  onset  of  the  program. 
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Table  22.  Summary  of  Findings  for  the  Tri-service 
Standardization  Investigation 


AREA  OF 
INVESTIGATION 

USAF  CSFDR 
RECOMMENDATION 

COMPATIBLE 

WITH 

USN  CONCEPTS 

COMPATIBLE 

WITH 

USA  CONCEPTS 

Flight  parameter 

Configuration  I, 
Configuration  II 
lists 

no  (audio 
desired) 

no  (impact 
gs  desired) 

Installation 

Separate  memory 
packages 

yes 

yes 

Crash-surviv¬ 
ability  and 
packaging 

Exceeds  TSO  C51, 
separate  memory 
pack 

yes  (ejectable 
memory) 

yes  (non- 
ejectable) 

Crash-protected 
memo  ry 

131,072  bits/ 

65,536  bits 

yes  (6,000,000 
bits  with  audio 
but,  50,000 
bits  with  data 
compression 
for  flight  data 
only) 

yes  (32,000 
bits  with 
data  com¬ 
pression) 

Conversion/ 

processing/ 

compression 

All  signal  types/ 
microprocessor 
adequate/ com¬ 
pression  used 

yes/yes/yes 

yes/yes/yes 

Ground  readout 
facility 

Three  choices 

Need  separate 
facility(s) 

Need  separate 
facility(s) 

Security 

protection 

Optional,  but 
design  concept 
feasible 

yes 

yes 

Military 

directives 

Compatible  with 

USAF  regulations 
and  manuals 

yes 

yes 

Expanded 

recording 

Separate  mass 
storage  unit 

yes 

yes 

Large-scale 

standardization 


yes 


yes 


yes 


3.2.2  Use  of  the  CSPDR  system  on  future  A/F/T  aircraft  -  The  basic 
CSFDR  system  will  provide  maximum  adaptability  for  application  to  future 
A/F/T  aircraft  such  as  the  next  generation  trainer,  the  B-52  Companion 
Trainer,  Stealth  derivative  aircraft,  and  forward  swept  wing  fighter. 

Figure  22  shows  the  general  procedure  which  will  enhance  usage  of  the 
CSFDR  system  on  future  A/F/T  aircraft  while  incorporating  new  tech¬ 
nologies  as  they  become  available.  The  procedure  begins  with  an  analysis 
of  the  existing  sensors  on  the  aircraft  under  consideration.  The  accuracy, 
type,  range,  dynamic  characteristics,  and  availability  of  signals  will 
be  determined.  Since  MIL-STD-1553  is  extremely  likely  to  be  implemented 
on  future  aircraft,  it  is  also  likely  that  the  vast  majority  of  required 
parameters  will  be  available  on  the  data  bus.  The  list  of  required  and 
desired  parameters  for  accident/mishap  investigation  developed  in  3.1.1 
will  be  compared  to  the  parameters  available  on  the  aircraft.  If  the 
sensors  and  parameters  are  not  sufficient  to  conduct  an  accident/mishap 
investigation,  a  list  of  new  sensors  required  will  be  made.  This  list 
will  include  the  required  sensor  characteristics  and  the  total  cost 
associated  with  their  integration  on  the  aircraft  in  a  format  similar  to 
that  given  in  3.1.1. 

The  next  step  required  is  a  data  conversion  analysis.  This  step 
may  not  be  required  if  the  M1L-STD- 1553  bus  is  available  and  contains 
the  required  parameters.  All  sensor  data  can  be  conditioned  and  for¬ 
matted,  as  well  as  providing  the  data  from  degraded  modes  as  failures 
occur,  by  integrating  CSFDR  system  requirements  into  the  aircraft  cen¬ 
tral  computer  and  outputting  words  on  the  data  bus.  The  recorder  is 
then  treated  as  an  additional  terminal.  In  the  event  that  some  of  the 
required  signals  are  not  on  the  1553  data  bus,  the  analog-to-digital 
conversion,  digitization,  discrete-data  conversion,  and  multiplexing 
requirements  will  have  to  be  identified.  If  such  is  the  case,  the  1/0 
adequacy  of  the  CSFDR  system  will  have  to  be  determined.  If  new  1/0 
functions  are  required,  they  will  be  defined  and  total  cost  for  their 
incorporation  will  be  computed.  However,  in  view  of  the  broad  multi¬ 
plexing  capabilities  of  the  DPU,  it  is  very  unlikely  that  new  1/0 
functions  will  be  required. 

The  data  conversion  analysis  is  followed  by  a  data-processing 
analysis  in  which  the  airborne  program  is  examined  for  application  on 
the  new  aircraft.  In  this  step,  the  parameter  list,  recording  rates, 
data  compression  subroutines,  and  other  special  requirements  such  as 
built-in  test,  warning  flags,  and  readout  capability  are  examined  for 
adequacy.  If  they  are  not  adequate  for  the  new  aircraft,  the  required 
software  modifications  will  be  outlined  and  the  cost  of  these  modifica¬ 
tions  will  be  computed.  Correspondingly  program  changes  and  associated 
costs  for  modifying  the  readout  facility  software  will  be  defined  and 
computed  respectively.  The  cost  of  this  step  is  minimal  since  the  CS1DR 
system  is  programmable  and  is  not  operating  near  its  saturation  levels. 
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Figure  22.  Future  A/F/T  Application  Procedure 
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The  fourth  and  most  important  step  of  figure  22  is  the  crash-survivable 
memory  impact  analysis.  Here  the  memory  size,  required  to  support  the 
recording  as  determined  in  the  preceding  steps,  will  be  determined  and 
compared  to  the  existing  CSFDR  system  memory.  If  a  memory  expansion  is 
required,  new  and  improved  memories  will  be  examined  and  traded  off 
against  expansion  of  the  survivable  memory  with  the  existing  technology. 
Costs  for  the  recommended  approach  will  be  identified. 

An  installation  analysis  is  the  next  step.  Mounting  locations  for 
the  CSFDR  system  (DPU,  CSMU,  and  cable  routing)  on  future  A/F/T  aircraft 
are  unknown  at  this  time.  The  CSFDR  system  and  installation  will  be 
tailored  to  each  aircraft  based  on  aircraft  design,  mission,  and  specific 
CSFDR  requirements.  The  aircraft  design  will  be  reviewed  and  potential 
DPU  and  CSMU  locations  will  be  selected  as  well  as  potential  routes  for 
electrical  cabling.  The  potential  locations  will  then  be  analyzed  with 
respect  to  existing  and  projected  accident/mishap  data,  aircraft  mission 
and  CSFDR  system  requirements,  and  an  installation  concept  will  be 
selected  to  provide  maximum  system  performance  and  survivability.  Also 
included  in  the  analysis  will  be  weight  and  balance  impact,  cable  lengths, 
and  mounting  requirements.  Installation  costs  will  be  computed  at  this 
point  The  installation  cost  will  be  relatively  small  based  on  the 
CSFDR  system  being  installed  as  orig  ;1  equipment  during  manufacture  of 
the  airframe.  Installation  of  the  CSMU  in  an  aircraft  extremity  is  very 
1 ikely. 

The  next  step  consists  of  making  a  cost/benefit  summary  for  application 
of  the  standard  FDR  to  the  new  aircraft  under  consideration.  All  of  the 
costs  associated  with  the  previous  steps  will  be  tallied,  and  the  resultant 
LCC  computed.  Then,  the  projected  accident  rate  for  the  new  aircraft 
will  be  calculated  with  and  without  the  CSFDR  system  to  determine  the 
expected  accident  rate  reduction  due  to  the  CSFDR  system.  The  accident 
rate  reduction  can  then  be  translated  into  dollar  savings  during  the 
useful  life  ot  the  aircraft  fleet.  The  total  dollar  savings  include  the 
cost  of  aircraft  saved,  the  cost  of  accident  investigations,  the  cost  of 
salvaging  the  crashed  aircraft,  and  the  cost  of  replacing  lost  aircrews. 

Such  a  cost/benefit  analysis  will  be  performed  in  the  same  manner  as  the 
analysis  in  3.3  of  this  report.  If  the  cost/benefit  analysis  results 
are  not  favorable,  all  of  the  above  analyses  will  be  repeated  as  shown 
in  figure  22  until  a  favorable  cost/benefit  summary  is  obtained.  In  the 
unlikely  event  that  a  favorable  cost/benefit  cannot  be  obtained  after  a 
few  iterations  of  the  process  in  figure  22,  the  results  of  the  analysis 
will  be  summarized  and  a  recommendation  will  be  made  based  on  the  results. 

Once  a  cost/benefit  summary  is  obtained,  a  recommendation  report 
will  be  prepared  and  delivered  to  the  Air  Force  program  manager  of  the 
subject  aircraft.  Contained  in  the  recommendation  report  will  be  a 
proposed  CSFDR  system  tailored  to  the  new  aircraft  to  provide  maximum 
system  performance  and  survivability.  The  report  will  also  include 
summaries  of  all  the  analyses  shown  in  ligure  22  as  well  as  a  summary  of 
the  cost/benefit  analysis. 
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Figure  22  is  designed  to  handle  all  cases  and  the  reader  should  not 
be  alarmed  when  reviewing  it.  The  recent  success  of  MIL-STD-1553, 
advances  in  microprocessor  capability,  and  incorporation  of  growth 
capability  into  the  standard  FDR  functions,  lead  us  to  believe  that  the 
majority  of  decision  blocks  in  figure  22  will  be  executed  on  the  "yes" 
branch  and  the  A  cost  computed  will  be  very  small  in  relationship  to  the 
value  of  benefits. 

The  impact  of  incorporating  future  technologies  such  as  improved 
sensors,  improved  signal  conditioning  and  I/O  hardware  building  blocks, 
improved  microprocessors,  improved  RAM  and  PROM  technologies,  and  improved 
crash-survivable  memories  will  be  made  evident  in  the  cost/benefit 
summary.  During  each  of  the  analyses  in  figure  22,  incorporation  of  new 
technologies  will  be  considered.  Corresponding  costs  and  data  will  be 
incorporated  in  the  procedure.  By  designing  standard  hardware  building 
blocks,  standard  instruction  sets,  and  growth  capability  into  the  standard 
CSFDR  system,  a  significant  performance  improvement  can  be  achieved  at 
minimal  cost  impact  through  incorporation  of  new  technical  advances. 

Figure  22  is  a  general  procedure  which  will  enhance  the  use  of  the 
proposed  standard  FDR  on  future  A/F/T  aircraft  while  maintaining  the 
flexibility  required  for  the  injection  of  new  technology. 

Advances  in  survivabie  memory  technology  are  easily  incorporated 
into  the  CSFDR  system  concept.  This  is  due  to  the  fact  that  the  survivabie 
memory  (CSMU)  is  designed  as  a  separate  building  block  and  communicates 
with  the  DPU  over  a  standardized  bus.  Thus,  new  survivabie  memories  can 
be  incorporated  into  the  system  without  affecting  the  standard  DPU 
design. 

Configuration  III  is  the  recommended  configuration  for  future 
aircraft.  Procurement  of  Configuration  III  will  eliminate  the  need  for 
additional  recorders,  and  all  of  the  recording  requirements  will  be 
satisfied  under  a  single,  standardized  recording  concept. 
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3.2.3  Large-scale  standardization  investigation 


3.2.3. 1  Need  for  large-scale  standardization  -  Standardizing  the 
CSFDR  system  for  A/F/'T  has  a  significant  effect  on  the  LCC  and  resulting 
cost/benefit  ratios.  Therefore,  broadening  the  scope  of  standardization 
to  include  bombers,  cargo,  transport,  and  helicopter  aircraft  should 
have  an  additional  positive  effect  on  the  LCC  and  overall  cost/benefit 
ratios . 

Additional  need  for  large-scale  standardization  is  evident  in  the 
Statement  of  Need.3  Paragraph  4.g  of  the  MENA  states  that  "there  should 
be  sufficient  standardized  capability  to  permit  adaptation  of  the  CSFDR 
system  to  larger  aircraft  and/or  helicopters  should  the  mishap  datu  for 
those  aircraft  support  later  incorporation."  However,  it  should  be 
noted  that  many  large  aircraft  in  the  DOD  inventory  now  use  FDRs. 
Examples  are  the  C - 1 4 1 ,  C-5A,  P-3,  S-3,  and  B-l  aircraft. 

3.2. 3. 2  Time  from  critical  event  to  mishap  -  In  3.3.2  (data  pro¬ 
cessing/data  compression),  the  assumption  is  made  that  the  vast  majority 
of  A/F/T  mishaps  can  be  resolved  by  retaining  the  last  15  minutes  of 
flight  in  the  CSMU.  Indeed,  discussions,  with  safety  personnel  indicate 
that  the  last  5  minutes  is  often  adequate  and  in  many  cases  the  last 
minute  is  sufficient  for  A/F/T  mishap  investigations.  This  assumption, 
of  retaining  the  last  15  minutes  of  flight,  thus  appears  to  be  more  than 
adequate  for  the  A/F/T  problem,  however,  it  is  not  a  valid  assumption 
for  large r ,  l owe r  performance  aircraft . 

Figure  23  shows  the  percentage  ot  accidents  (for  commercial-type 
aircraft)  which  can  be  resolved  by  retaining  variable  amounts  of  per¬ 
tinent  recording  times.  This  data  is  based  upon  NTSB  and  USN  ULAIDS 
studies  and  is  applicable  to  aircraft  such  as  the  Boeing  727  and  the 
Lockheed  P-3C.  This  figure  shows  that,  in  order  for  the  recorder  to  be 
beneficial  in  over  95  percent  of  mishap  investigations  for  larger  air¬ 
craft,  a  pertinent  recording  time  of  30  minutes  is  a  better  assumption. 
Therefore,  for  the  larger,  lower  performance  aircraft,  it  is  recommended 
that  the  data  processing/data  compression  techniques  permit  a  nominal 
time  of  30  minutes  of  data  to  be  retained  before  memory  wraparound 
occurs.  This  will  provide  an  adequate  margin  of  safety  for  turbulent 
flights  in  which  memory  wraparound  could  occur  in  less  than  30  minutes. 


3 1  h  i  d . 
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3. 2.3.3  Parameter  lists  for  large  aircraft  and  memory  required  -  A 
very  wide  range  of  parameter  lists  exists  for  the  larger  military  aircraft. 
These  lists  vary  from  the  very  simplified  list  associated  with  metal 

foil  type  recorders,  which  are  comprised  of  about  5  to  10  basic  parameters, 
to  the  very  comprehensive  lists  associated  with  tape  FDRs.  such  as  the 
B-l  bomber  list  which  is  comprised  of  40  basic  parameters  over  a  30-minute 
recording  interval.  However,  these  lists  do  not  pose  a  problem  to  the 
selected  CSFDF  system  concept.  As  was  shown  in  3.1.2,  the  decision  was 
made  to  separate  the  CSMU  from  the  DPU.  This  separation  allows  a  family 
of  CSMU  modules  to  operate  in  conjunction  with  a  single  DPU.  Therefore, 
a  separate  CSMU  is  recorsmended  for  application  to  large  aircraft  which 
require  comprehensive  parameter  lists  for  extended  recording  times. 

This  CSMU  shall  operate  in  conjunction  with  the  standard  DPU. 

Based  upon  our  review  of  parameter  lists,  it  is  recommended  that 
the  expanded  CSMU  be  capable  of  recording  120  signals  (approximately  40 
to  60  parameters)  for  a  nominal  time  period  of  30  minutes.  Based  upon 
the  data  processing/data  compression  techniques  of  3.3.2,  this  translates 
to  a  requirement  for  the  CPM  of  16K  x  16  bits/word  (262,144  bits). 

3. 2. 3. 4  Installation  on  large  aircraft  -  Installation  on  large 
aircraft  is  straightforward,  and,  in  fact,  easier  than  on  A/F/T  aircreft. 
This  is  primarily  due  to  the  relaxing  of  the  size  and  weight  restriction 
and  to  the  larger  availability  of  space  on  these  aircraft.  Moreover,  a 
requirement  for  a  deployable  unit  can  be  satisfied  by  simply  packaging 
the  CSMU  on  the  ejectable  package  (air  foil  or  other),  if  a  deployable 
unit  is  desired. 

Historically,  recorders  for  these  aircraft  1  .ve  demonstrated  a 
higher  degree  of  survivability  when  the  recorders  were  installed  at  or  near 
the  tail  sections  of  the  aircraft.  The  recommended  approach  of  separating 
the  CSMU  from  the  DPU  would  permit  the  CSMU  to  be  installed  in  or  near 
the  tail  section  and  would  minimize  the  overall  weight  impact  to  the 
aircraft  since  the  sensor  input  lines  would  not  have  to  run  to  the  tail 
section,  but  only  to  the  DPU. 

3.2.J.5  Crash  survivability  for  large  aircraft  -  The  environment 
for  helicopter,  cargo,  transport,  and  bomber  aircraft  tends  to  be  less 
severe  in  the  impact  area,  and  more  severe  in  the  areas  of  penetration 
and  static  crush.  This  is  a  direct  result  of  the  slower  moving,  more 
massive  aircraft.  Historically,  TS0-C51A  has  been  adequate  for  these 
aircraft,  especially  when  the  recorder  is  located  in  the  tail  section. 
Therefore,  the  CSMU  for  the  large  aircraft  should  be  designed  to  meet 
the  crash-survivability  specifications  of  TS0-C51  with  a  slight  increase 
in  the  flame  test  time  to  allow  for  application  to  helicopters  which 
historically  have  localized  post-crash  fires.  Therefore,  the  crash- 
survivability  specification  recommended  for  the  large-scale  integration 
CSMU  is  as  shown  in  table  23. 
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Table  23.  Summary  of  Major  Crash-Survival  Requirements  for 
Large-Scalr  Integration  CSMU 


Impact 

1000-g  half  sine  wave  for  5  msec 

Penetration 

500-lb  weight  dropped  from  10  feet  on 
0.05-square  inch  area 

Static  crush 

5000-lb  continuous 

Fire 

1100°C  on  5°%  of  outside  area  for 

24  minutes 

Water 

Immersed  in  sea  water  for  4  weeks  (or 
equivalent  accelerated  test) 

3 . 2 . 3 . 6  Data  conversion/data  processing/data  compression  for  large- 
scale  integration  applications  -  In  general,  the  discussions  of  the 
conversion,  processing,  and  compression  functions  in  3.3.2  are  also 
applicable  to  the  large-scale  integration  aircraft.  The  full  range  of 
signal  types  cn>  be  converted  within  the  DPU  signal  conditioning  subsec¬ 
tions.  In  sorr.^  cases,  certain  parameters  may  have  to  be  rescaled.  For 
example,  an  eight-bit  word  is  used  to  provide  a  30,000-pound  range  with 
a  resolution  of  117  pounds  for  the  A/F/T  applications.  For  some  large- 
scale  applications  the  same  eight-bit  word  would  provide  a  225,000  pound 
range  but  only  to  a  resolution  of  879  pounds  (the  KC-135A  has  a  total 
net  fuel  capacity  of  203,288  pounds).  The  processing  and  compression 
functions  used  for  the  A/F/T  applications  are  also  directly  applicable 
to  the  large-scale  integration  aircraft.  In  fact,  in  most  cases,  better 
bit  compression  ratios  would  be  attained,  although  this  would  not  neces¬ 
sarily  be  true  for  higher  performance  bombers  such  as  the  B-l .  Some 
aperture  sizes  could  be  widened  in  order  to  achieve  better  bit  compres¬ 
sion  ratios  while  maintaining  enough  accuracy  to  conduct  meaningful 
accident  investigations.  These  minor  changes  in  DPU  functions  are 
easily  achieved  because  of  two  factors. 

•  The  DPU  is  reprogrammable. 

•  The  processor  resident  within  the  DPU  is  operating 
at  approximately  10  percent  of  its  throughput  for 

the  A/F/T  application  and,  therefore,  easily  accommodates 
new  functions. 
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3.2. 3. 7  Multiple  recorders  -  In  order  to  achieve  extremely  high 
reliabilities  and  survival  rates,  some  large-scale  integration  candidates 
such  as  the  B-52  may  desire  two  recorders  on  board.  Totally  independent 
data  buses  may  also  dictate  that  some  aircraft  have  two  recorders  on 
board.  This  concept  is  easily  achieved  in  either  of  two  ways: 

•  Use  a  separete  DPU  and  CSMU  for  each  recording  system. 

•  Use  a  single  DPU  to  drive  multiple  CSMUs . 

3. 2. 3. 8  Expanded  recording  functions  for  large-scale  integration  - 
Expanded  recording  functions  for  the  large-scale  integration  applications 
are  also  feasible.  In  fact,  in  many  cases,  these  functions  have  less  of 
an  impact  on  the  CSFDR  system  than  corresponding  requirements  for  the 
A/F/T  configurations.  For  example,  in  the  case  of  ASIP  functions,  the 
B-52  requires  fewer  parameters  than  either  the  A-10,  F-15,  or  F-16, 
although  longer  time  histories  are  involved.  Ir.  general,  the  expanded 
recording  functions  for  the  large-scale  integration  aircraft  are  comparable 
to  those  of  the  A/F/T  class. 

3. 2. 3. 9  Large-scale  integration  recommendation  -  The  recommended 
approach  is  compatible  with  the  concepts  of  large-scale  standardization. 
However,  this  requires  an  additional  building  block  module  for  the 
family  of  CSFDR  system  configurations.  The  additional  module  is  a  new 
CSMU  over  and  above  that  required  for  A/F/T  standardization  applications. 
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3.2.4  Expanded  recorder  functions  (Configuration  III)  -  Expanding 
recorder  functions  to  include  turbine  health  parameters  and  ASIP  parame¬ 
ters  has  only  a  modest  effect  on  increasing  the  computing  capacity 
requirements  of  the  CSFDR  recorder  system.  Signal  conditioning  and 
preprocessing  requirements  increase  in  proportion  with  quantity  and  type 
of  added  parameters.  Engine  health  recording  is  considered  first, 
followed  by  a  discussion  of  incorporating  ASIP  recording. 

If  engine  health  recording  is  added  to  the  CSFDR  Configuration  I, 
then  very  little  addition  is  needed  for  ASIP  incorporation.  The  need 
for  adequate  ground  readout  equipment  at  each  base  would  already  be 
established.  Compiling  ASIP  data,  removed  with  engine  data,  would 
require  only  a  small  simple  addition  to  the  ground  readout  equipment. 

One  additional  non-protected  memory  in  the  aircraft  could  serve  both 
functions.  The  added  memory  would  require  about  double  the  capacity  of 
the  engine  recorder  alone  and  could  be  sized  according  to  engine  quantity 
and  flight  durations. 

If  engine  health  recording  is  not  done  in  the  CSFDR,  and  ASIP  only 
is  added,  the  memory  size  will  be  made  larger  to  decrease  the  readout 
interval  which  reduces  the  frequency  of  recording  media  removal  and 
handling.  ASIP  is  trend  data  and  is  used  basically  in  long-term  planning 
in  airframe  life  maintenance  or  extension.  A  more  complicated  data 
handling  would  result  from  lack  of  a  local  readout  capability  and  a  need 
to  send  paperwork  and  recording  media  to  a  central  data  facility.  An 
added  ASIP-only  solid-state  memory  with  a  15-hour  capacity  and  requiring 
many  units  per  aircraft  to  fill  the  mailing  system  pipeline  would  raise 
the  total  system  cost.  In  combination  with  the  engine  health  recording, 
ASIP  data  could  be  accumulated  on  computer  cassette  tape  for  monthly 
transmittal  to  the  data  processing  center,  or  printouts  could  be  for¬ 
warded  directly  to  the  ASIP  office,  effecting  considerable  time  and 
savings . 

This  concept  looks  particularly  inviting  where  new  engine  health 
programs  are  being  considered  anyway.  Pertinent  programs  are  the  requested 
TEMS  (turbine  engine  monitoring  system)  for  the  A-10  and  the  EDS  (engine 
diagnostic  system)  for  the  F-100  engine  used  in  F-15  and  F-16  aircraft. 
These  systems  wiii  be  discussed  further  in  paragraphs  dedicated  to  the 
specific  aircraft. 

A  Configuration  III  system  with  both  engine  health  recording  and 
ASIP  recording  is  practical.  It  is  a  modestly  expanded  Configuration  I 
system  with  an  added  non-volatile  memory  (non-survivable  memory).  A 
Configuration  II  system  is  too  limited  and,  if  chosen,  should  be  "stand 
alone"  with  engine  health  and  ASIP  recorders. 
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A  Configuration  III  system,  unlike  I  or  II,  will  require  recording 
during  ground  operatior  as  well  as  when  airborne.  The  crash-protected 
memory  will  still  record  only  as  in  Configurations  I  or  II. 

3.2.4. 1  Engine  health  -  The  existing  engine  health  recorders  can 
be  of  the  ETTR  type  (engine  time/temp,  recorder)  which  giv^s  time  dura¬ 
tion  that  a  critical  temperature  parameter  exceeds  pr^^ti  temperature 
thresholds  (such  as  a  low  temperature  for  engine  ON  time,  an  intermediate 
temperature  for  continuous  normal  operation,  and  a  high  temperature  for 
maximum  power  time) .  The  TEMS  type  (turbine  engine  monitoring  system) 
provides,  in  addition  to  a  time/temperature  history,  rpm  (Nlt  N2) , 
turbine  high  pressure  output  (ahead  of  combustor) ,  bearing  temperatures 
and  vibration,  oil  temperature,  throttle  position,  BUC  and  other  status, 
oil  pressure,  I.T.T.,  nozzle  position  as  applicable,  chip  detector,  and 
selected  others. 

If  the  minimum  CSFDR  configuration  system  is  chosen  for  A/F/T 
aircraft,  addition  of  the  engine  health  parameters  would  not  be  practical 
because  of  the  necessary  added  sensing  points  on  the  engine  and  the  need 
for  support  equipment  for  daily  data  dump  and  readout.  The  Configuration  1 
system  will  already  record  those  engine  parameters  available  to  the 
cockpit  area.  The  addition  of  the  remaining  desired  parameters  is 
relatively  easy  if  it  is  decided  to  equip  the  aircraft  with  a  TEMS  or 
EDS  type  of  system  minus  the  individual  processors  and  recorders.  The 
combined  system  makes  much  more  economical  use  of  space,  hardware,  and 
ground  processing  equipment  than  three  stand-alone  systems. 

The  additional  signals  can  b°  processed  and  compressed  in  the  same 
manner  as  the  other  CSFDR  signals  except  for  engine  vibration  sensors. 

These  signals  need  a  very  high  sampling  rate  to  reconstruct  their  signa¬ 
ture.  The  signature  only  needs  recording,  however,  when  changes  occur. 
Certain  types  of  preprocessing,  such  as  use  of  octave  band  filters,  and 
RMS  level  thresholds  on  these  bands,  would  permit  lowering  of  the  sample 
rate  and  still  permit  monitoring  of  vibration  changes. 

For  engine  health,  AS1P,  and  flight  control  monitoring,  a  total  of 
15  hours  of  recording  in  a  256  K  mass  memory  (electrically  alterable)  is 
assumed  and  used  for  later  cost  analysis  to  cover  all  possible  applications 
(including  the  B-52).  If  only  engine  health  for  a  single-engine  aircraft, 
or  only  AS1P,  which  is  required  on  only  every  fifth  airplane,  is  chosen 
for  a  Configuration  III  application,  considerably  less  total  memory  is 
required.  So  many  variations  exist  that  only  the  most  comprehensive  is 
used  in  the  model  to  demonstrate  effectiveness. 

a.  A- 10.  The  A- 10  presently  has  only  an  ETTR  system  on-board 
but  is  a  candidate  for  a  TEMS  system,  hopefully  in  the  near  future. 

Engine  instrumentation  designed  or  installed  for  a  TEMS  system  can  just 
as  easily  be  recorded  in  the  augmented  CSFDR  system  providing  common 
usage  of  on-board  equipment  and  ground  processing  equipment.  The 
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specific  parameters  needed  for  the  proposed  TEMS,  in  addition  to  those 
already  monitored  by  the  Configuration  I  system  are: 

(1)  Compressor  discharge  pressure 

(2)  Oil  temperature 

(3)  Bearing  temperature  (probably  temperature  of  four 
oil  scavenge  lines) 

(4)  Vibration  sensors  (two  quadrature  pairs  or  triplets, 
three  to  six  sensors) 

(5)  Chip  detectors  (up  to  5)  (DC  threshold) 

(6)  Engine  serial  number  (and  location) 

(7)  Aircraft  serial  number  (Date  and  time  can  be  added 

upon  readout) 

The  sensors  are  mostly  DC  analog  type  (such  as  thermocouples)  and 
possibly  a  synchro  AC  analog  output.  The  vibration  sensors  would  have 
outputs  similar  to  microphone  outputs  which  will  require  preamplifiers 
and  special  processing  previously  mentioned. 

The  total  increase  in  signals  to  record  is  approximately  33  (both 
engines) . 

The  total  number  of  parameters  to  record  in  the  mass  memory  is  46. 

b.  F-15.  The  F-15  presently  uses  an  ETTR  type  of  recorder 
with  electromechanical  counters  showing  time/history  of  low  cycle  fatigue, 
hot  section  time  level  I,  hot  section  time  level  II,  and  engine  time. 

It  contains  electromechanical  indicators  for  over-temperature ,  hot 
start,  N!  overspeed  and  Nj  sensor  fault. 

The  time/temperature  data  provides  immediate  information  on  probable 
operating  time  before  replacement,  and  the  indicators  provide  an  immediate 
no-go  status.  Much  information  needed  is  not  available,  such  as  the 
number  of  stalls  or  stagnation  durations.  This  need  (and  the  on-going 
F-100  engine  stall  susceptibility)  has  led  to  the  EDS  program.  The 
Engine  Diagnostic  System  program  evaluation  model  is  presently  on  board 
an  F-15  in  its  validation  phase  (April  '80  -  June  '81).  In  addition  to 
the  engine  parameters  presently  available  in  the  cockpit  and  on  the 
ETTR,  EEC  parameters  are  monitored  and  21  sensors  are  added.  These 
include  a  3-axis  vibration  sensor  on  the  gear  box,  four  each  of  scavenge 
pump  oil  temperature  and  pressure  sensors,  with  the  seven  FTIT  probes 
monitored  separately  to  cover  the  maximum/minimum  temperature  spread. 

Other  existent  pressure  and  temperature  sensors  are  recorded. 
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The  data  is  recorded  in  a  64-K  EAROM  and  evaluated  after  every 
flight  during  validation  (probably  daily  in  operation).  A  maintenance 
advisory  panel  located  inside  door  48L  displays,  seven  no-go  conditions, 
and  seven  maintenance  advisory  parameters.  A  multiplexer  is  located  on 
the  engine  to  reduce  the  wir2  runs  to  the  recorder.  The  system  uses  an 
8080  family  microprocessor 

It  is  understood  that  all  parameters  monitored  on  the  validation 
system  may  not  be  required  in  a  production  system.  That  information 
should  be  available  at  completion  of  EDS  system  evaluation.  The  engine 
retrofit  is  extensive  enough  to  make  it  non-interchangeable  with  non- 
equipped  engines.  Of  some  concern  is  that  such  a  system  may  not  go 
aboard  F-15s  at  all,  but  only  on  F-16  and  perhaps  later  designs.  Cost 
effectiveness  is  yet  to  be  proven  in  respect  to  whether  all  or  only  some 
aircraft  should  be  equipped. 

Consequently  there  are  several  ways  any  effort  to  integrate  engine 
health  recording  into  the  Configuration  III  CSFDR  system  could  go. 

On  the  assumption  that  the  F-15  is  too  far  downstream  and  the  cost 
of  an  EDS  by  itself  is  too  high  to  warrant  retrofit,  the  ETTR  parameters 
and  certain  selected  added  parameters  could  result  in  a  cost  effective, 
reduced  scale  EDS  when  integrated  with  the  CSFDR  Configuration  III 
recorder 

The  following  parameters  are  considered  added  for  Configuration  III 
(the  results  of  the  EDS  validation  will  provide  the  real  determination) 
for  the  purposes  of  this  study. 

(1)  ?T  pressure  probe 

]  6 

(2)  CIVV  position  (resolver) 

(3)  Oil  temperature  (sensor  may  be  present) 

(4)  Four  oil  scavenge  return  temperatures  and  pressures 
(.very  tentative) 

(5)  Vibration  sensor  triad  on  gear  box 

(6)  Chip  detector  status  (4?) 

(7)  Fan  exit  temperature  (thermocouple) 

(8)  T^^  (inlet  temperature  thermocouple) 
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(9)  Vw,„  (switch  closure  discrete) 

MAX 

(10)  Possibly  FTIT  separation  to  seven  outputs) 

(11)  Engine  serial  numbers  and  location 

(12)  Aircraft  serial  number 

The  above  list  constitutes  the  maximum  parameters  added  above  those 
engine  parameters  already  in  the  Configuration  I  list. 

The  total  added  for  two  engines,  therefore,  becomes  approximately 
57  additional  signals  to  record. 

The  total  parameters  to  be  recorded  in  the  mass  memory  module  is 
71. 


c.  F-16.  Most  of  the  foregoing  general  discussion  of  the  EDS 
system  also  applies  to  the  F-16.  The  odds  favor  installation  of  such  a 
system  on  F-16  blocks  yet  to  be  built.  Retrofit  of  those  built  is  more 
questionable.  But  if  not,  it  would  once  again  brir  ,  up  the  problem  of 
engine  interchangeability. 

If  the  same  parameter  assumptions  are  made  as  for  the  F-15,  then 
the  same  29  signals  (one  engine)  plus  Nx  and  an  actual  nozzle  position 
parameter  should  be  recorded  for  a  total  of  31  maximum  added  for  engine 
health  data.  The  total  to  be  recorded  in  the  mass  memory  is  37  parameters. 
If  the  assumption  is  made  that  the  entire  EDS  system  parameters  will  be 
implemented,  then  an  addition  of  about  15  more  parameters  would  be  made. 

The  use  of  a  multiplexer  on  th*  engine  reduces  the  wire  bundle  size 
necessary  to  go  to  the  recorder  (which  is  probably  necessary,  particularly 
for  the  F-16),  but  does  appear  to  limit  the  options  for  data  compression 
as  indicated  by  the  EDS  64-K  memory  size.  The  tradeoff  between  pre¬ 
processing  for  compression  ahead  of  multiplexing  would  have  to  be  made 
against  the  cost  of  the  larger  memory  required.  Preprocessing  ahead  of 
the  MUX  may  allow  the  addition  of  engine  health  parameters  to  an  otherwise 
standard  Configuration  I  processor  resulting  in  overall  standardization 
improvements . 

3. 2. 4. 2  ASIP  functions  -  The  aircraft  structural  integrity  program 
presently  monitors  selected  parameters  for  nearly  all  aircraft  types  in 
the  active  inventory.  These  parameters  are  selected  to  permit  long-term 
monitoring  for  analyzing  and  predicting  airframe  stress  and  fatigue 
life.  By  monitoring  the  operational  environment,  the  aircraft  can  be 
repaired  as  required  in  an  orderly  and  scheduled  manner,  thus  allowing 
minimum  unscheduled  down  time  and  the  elimination  of  potentially  dangerous 
conditions.  The  program  is  intended  to  provide  safe  aircraft  throughout 
the  design  life  span. 
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The  requirements  for  this  program  are  spelled  out  in  AF  regulation 
80-13  and  in  military  standard  MIL-STD-1530A(11) . 

Various  recorder  systems  are  used,  such  as  the  ASH-28  on  the  F-15, 
and  the  MXU-553/A  on  the  A-10  and  F-16.  Input  parameters  ere  obtained 
in  various  manners  in  the  three  aircraft.  Generally  speaking,  most  data 
is  obtained  from  added  sensors.  This  is  a  good  approach  where  only 
every  fourth  to  sixth  airplane  is  equipped  with  the  recorder  and  no 
standard  source  of  data  is  already  common  to  the  various  aircraft. 

Added  accelerometers  and  gyros  are  costly. 

Table  24  is  included  to  show  the  ASIP  parameters  currently  recorded 
for  15  types  of  aircraft.  Flight  durations  can  be  from  an  hour  to  15  to 
18  hours.  Typically  this  has  required  tape  transports  to  cover  the  data 
for  the  full  duration.  On  short  flight  A/F/T  types,  the  15-hour  duration 
has  proved  useful  in  requiring  only  2  to  4-week  tape  cartridge  changes. 
The  Configuration  III  CSFDR  version  augmented  to  include  engine  health 
and  ASIP  functions  can  be  configured  in  many  variations. 

The  parameters  to  be  added  to  Configuration  I  for  covering  the  ASIP 
requirement  are  few.  The  cost  impact  on  the  Configuration  I  system  is 
minimal.  The  greatest  variable  is  in  sourcing  the  body  axis  dynamics 
inputs  and  iri  obtaining  the  control  surfaces  inputs.  An  effort  has  been 
made  to  obtain  these  from  existing  sources  where  possible,  such  as  the 
IMU,  central  computers,  and  the  flight  control  system.  Dynamics  data, 
other  than  the  flight  control  system,  is  from  the  MUX  bus;  hence,  it 
requires  minimum  added  wiring. 

The  greatest  cost  addition  of  ASIP  to  the  Configuration  1  CSFDR 
(without  EHR)  is  found  in  added  mass  memory  and  in  the  ground  processing 
equipment  necessary  to  extract  the  data  and  transfer  it  to  less  costly 
tape  for  transmittal  to  data  processing  centers. 

Some  similar  associated  data  is  obtained  from  the  existing  acceler¬ 
ometer  counter  set  on  each  airplane.  This  data  is  presently  manually 
read  and  recorded  on  report  forms  from  the  data  recorded  on  the  face  of 
the  unit  (A8K-17/A37J-8) .  This  same  data  could  easily  be  recorded  on 
all  aircraft  using  Configuration  III. 

As  stated  in  3.2.4. 1,  Configuration  III  can  appear  in  many  forms. 

The  one  used  for  cost  tradeoffs  in  this  study  is  just  one  of  these 
several,  and  assumes  the  256-K  memory  version  with  ASIP  data  retrieved 
after  15  flight  hours  (or  simultaneous  engine  parameter  recording  with 
daily  data  retrieval). 

A  decision  on  combining  engine  health  recording  with  CSFDR  is 
important  to  the  ASIP  decision. 
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Table  24 .  Parameter  List  (MXU-553/4  and  AN/ASH-28 
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If  the  engine  health  systems  are  added  to  Configuration  I  (making 
Configuration  III)  and  the  ground  equipment  is  added  for  after-flight  or 
daily  readout,  then  the  ASIP  functions  are  a  miminum  add-on. 

Configuration  I  would  monitor  about  90%  of  the  ASIP  program  needs 
as  is.  It  is  relatively  simple  to  add  the  needed  parameters.  The  data 
recording  period  and  readout  needs  are  different  from  either  the  crash 
recorder  needs  or  the  engine  health  needs.  ASIP  data  is  trend  data  and 
does  not  need  to  be  collected  more  than  once  a  month  or  every  15  flying 
hours.  The  solid-state  recorder  memory,  to  be  most  practical,  should  be 
dumped  at  the  end  of  each  flight  (or  day)  at  the  same  time  that  the 
engine  health  data  is  removed.  At  these  times,  it  could  easily  be 
stored  on  a  cassette  and  accumulated  for  the  desired  time  or  printed  out 
on  a  printer.  This  eliminates  the  long  time  on-board  storage  capacity 
for  ASIP  data . 

The  advantages  of  recording  both  engine  health  and  ASIP  data  on  a 
common  recorder  is  that  all  parameter  identification  data,  dates,  times, 
A/C  identification,  etc.,  can  ail  be  conveniently  printed  out  using  one 
common  ground  data  processing  unit  at  each  base.  Many  laborious  and 
error  prone  hand-written  forms  could  be  eliminated.  Data  could  then  be 
transmitted  in  digital  form  or  by  mailed  printouts  directly  to  the  user 
organizations.  In  other  words,  ASIP  and  engine  data  can  be  added  for 
little  more  than  engine  data  alone. 

Therefore,  from  the  standpoint  of  ASIP  recording  program  costs,  the 
decision  to  add  engine  health  recording  is  important. 

Again,  as  with  the  engine  health  requirements,  the  CSFDR  system 
Configuration  11  is  not  compatible  with  the  ASIP  needs,  mainly  from  the 
point  of  view  of  ground  data  readout  and  handling. 

Assuming  that  existing  aircraft  with  ASIP  recorders  have  the  CSFDR 
system  added  and  the  choice  is  to  use  Configuration  II,  then  it  is 
recommended  that  the  ASIP  stay  as  is. 

Combining  the  ASIP  functions  with  the  CSFDR  system  and  engine 
health  recording  would  relieve  some  space  presently  occupied  by  ASIP 
boxes  providing  space  for  the  common  recorder  and,  in  the  F-I6,  allowing 
the  VTR  to  be  returned  to  the  present  ASIP  designated  aircaraft. 

The  following  paragraphs  delineate  the  specific  changes  or  additions 
to  the  parameter  list  of  Configuration  1  to  perform  the  complete  ASIP 
funct ions . 
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a.  A-10.  For  the  A-10,  only  the  following  parameters  need  be 
added  to  the  Configuration  I  version: 

(1)  Strain  gauge  (1)  and  -mplifier 

(2)  Aircraft  serial  number  and  squadron  number 

(3)  Date  (month,  day,  year) 

Parameters  in  Configuration  I  that  will  be  available  for  ASIP: 

(1)  Angle  of  attack 

(2)  Right  elevator  position 

(3)  Left  elevator  position 

(4)  Right  aileron  position 

(5)  Left  aileron  position 

(6)  Right  rudder  position 

(7)  Left  rudder  position 

(8)  Leading  edge  slat  position 

The  total  number  of  parameters  that  may  be  recorded  for  ASIP  is  31. 

b.  F-15.  For  the  F-15,  only  the  following  parameters  need  to 

be  added: 

(1)  Longitudinal  acceleration 

(2)  Roll  acceleration 

(3)  Strain  gauge  and  amplifier 

(4)  Ramp  door  open 
Flaps  data  is  available  if  desired. 

Four  parameters  are  added  to  the  Configuration  I  CSFDR  list.  A 
total  of  20  ASIP  parameters  will  be  recorded  on  the  mass  memory. 

(One  of  these  parameters,  Weapons  Configuration  and  Status,  consists  of 
18  digital  words  in  the  Configuration  I  list.) 
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The  existing  ASH-28  ASIP  recorder  contains  its  own  sensors  for  the 
above  first  two  parameters.  If  combined  with  the  CSFDR,  the  two  sensors 
will  need  to  be  added,  or  the  data  can  be  derived  fro>si  inertial  data. 

Other  ASH-28  self-contained  sensors  have  equivalent  signals  from  other 
sources  already  in  the  Configuration  I  list. 

c.  F-16.  For  the  F-16,  only  the  following  parameters  need  to 

be  added: 

(1)  Strain  gauge  and  amplifier 

(2)  Longitudinal  acceleration  (could  be  computed  from 

inertial  data) 

(3)  Roll  acceleration 

(4)  Aircraft  serial  number  and  squadron  number 

(5)  Date  (month,  day,  year) 

Five  parameters  are  added  to  the  Configuration  1  CSFDR  list.  A 
total  of  23  parameters  will  be  recorded  in  the  mass  memory. 

3. 2. 4. 3  Flight  control  monitoring  -  Some  flight  control  monitoring 
is  done  in  Configuration  II,  such  as  the  primary  control  surfaces  and 
pilot  inputs,  as  well  as  critical  CAS  warning  discretes.  Comprehensive 
monitoring  is  done  in  the  Configuration  1  version  which  includes  Config¬ 
uration  II  parameters  plus  many  more  status  and  fail  discretes. 

Only  the  F-16  has  more  detailed  data  on  the  FCS  which  is  recorded 
on  the  ejection  seat  recorder.  It  is  believed  that  those  parameters 
necessary  for  crash  analysis  are  recorded  on  the  survivable  memory  in 
Configuration  i,  but  if  all  of  the  signals  presently  on  the  seat  recorder 
are  desired,  they  can  easily  be  accommodated  by  picking  up  existing 
wiring  from  the  ECA  and  from  the  FLCC  connector  to  the  present  seat 
recorder.  If  the  monitoring  electronics  continue  to  be  prodvred  in  the 
ECA  and  FLCC,  then  acquiring  FCS  status  parameters  from  this  source 
would  be  preferred  over  the  individual  discrete  sources  shown  in  the 
F-16  Configuration  1  list  because  they  will  all  be  available  on  Manchester 
coded  data  buses.  The  ECA  and  FLCC  output  a  total  of  96  fail  or  status 
bits  and  provide  good  repair  or  troubleshooting  diagnostics. 

For  the  A-10  and  F-15,  a  fair  amount  of  FCS  data  is  recorded.  More 
discretes  could  easily  be  added  if  required. 
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3.2.5  Security  of  recorded  data  -  The  purpose  of  the  study  for 
this  section  is  to  (1)  determine  the  depth  of  any  potential  data  security 
problems  which  could  arise  from  CSFDR  system  use  and  (2)  state  feasible 
solutions  to  the  problems. 

3.2.5  1  Parameter  lists  and  associated  intelligence  -  A  mishap 
resulting  from  flight  over  enemy  territory  could  result  in  enemy  recovery 
of  the  CSMU.  Recovery  of  the  expanded  memory  modules  used  for  ASIP, 

TEH,  and  FC  recording  cannot  generally  be  used  to  produce  readouts  since 
these  memory  modules  are  not  crash-survivahle .  Moreover,  these  modules 
are  easily  accessible,  and  can,  therefore,  be  easily  removed  prior  to 
flight  over  enemy  territory.  Therefore,  the  discussion  of  security  of 
recorded  data  is  restricted  to  the  CSMUs  associated  with  Configurations 
I  and  II.  This  further  implies  that  the  parameter  lists  associated  with 
these  two  configurations  must  be  reviewed  in  order  to  determine  whether 
or  not  enemy  knowledge  of  their  time  histories  is  a  critical  problem. 

Table  25  shows  the  information  which  could  be  deduced  from  the  time 
histories  of  the  Configuration  I  and  II  parameter  lists.  It  must  be 
remembered  that  complete  time  histories  of  these  parameters  will  not  b" 
available  because  of  the  memory  wraparound  which  will  typically  occur. 
(Typically,  memory  wraparound  occurs  after  29  minutes  and  19  minutes  for 
Configurations  I  and  II,  respectively.) 

Aircraft  capability  and  performance  limitations  could  be  deduced 
from  time  histories  of  relative  time,  airspeed,  altitude,  attitudes, 
attitude  rates,  fuel  quantities,  fuel  rates  and  velocities.  In  general 
this  information  would  be  available  for  unclassified  aircraft  in  various 
technical  orders,  magazines,  and  other  publications.  However,  an  accumu¬ 
lation  of  data  from  a  series  of  mishaps  could  provide  the  enemy  with  an 
approximation  of  aircraft  capability  and  performance  limitations  if  some 
of  the  flights  operated  at  or  near  the  performance  limit. 

Pilot  tactics  and  maneuvers,  and  weaknesses  therein,  could  be 
deduced  from  the  time  histories  of  the  same  parameters  listed  in  the 
previous  paragraph.  A  good  example  would  be  the  case  where  a  fighter 
aircraft  engaged  in  dogfight  maneuvers  entered  an  uncontrolled  spin  and 
crashed  in  enemy  territory.  The  conditions  which  caused  the  departure 
of  controlled  flight  could  be  well-defined  and  recorded  in  the  CSMU. 
Accumulation  of  this  type  of  data  could  result  in  a  very  thorough  know¬ 
ledge  of  pilot  tactics  and  maneuvers. 

Base  locations  could  possibly  be  deduced  from  a  time  history  of 
airspeed  and  heading  or  velocities.  Altitude  would  supplement  this 
information.  Bec.i  e  of  the  expanded  time  histories  in  Configuration  I, 
this  configuration  i  the  more  susceptible  one  to  this  problem.  With 
memory  wraparound  oct  ring  more  frequently  in  Configuration  II,  it  is 
not  likely  that  base  locations  can  be  deduced  directly  from  its  CSMU. 
Also,  it  is  highly  unlikely  that  actual  base  numbers  can  be  deduced  from 
either  configuration. 
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Table  25.  Intelligence  Which  Could  Be  Derived  from  CSMU  Data 


INTELLIGENCE 

DEDUCED  FROM 
CONFIGURATION  I 

CSMU 

DEDUCED  FROM 
CONFIGURATION  II 

CSMU 

Aircraft  capability 
and  performance 

Yes,  to  the  extent  recorded 
and  accumulated 

Yes,  to  the  extent  recorded 
and  accumulated 

Pilot  tactics  and 
maneuvers  (and 
weaknesses  therein) 

Yes ,  to  the  extent  recorded 
and  accumulated 

Yes,  to  the  extent  recorded 
and  accumulated 

Base  locations/ 
numbers 

Sometimes/no 

Rarely/no 

Routes  flown 

Sometimes 

Rarely 

Equipment  on  board 
and  associated 
rel iabi 1 ity 

Yes/rarely,  if  ever 

Yes/rarely,  if  ever 

Altitude  prof i 1 es 

Yes 

Yes 

Numbers  of  aircraft 
being  used  locally 

e 

o 

z 

No* 

Temporary 
rendezvous  points 

Sometimes 

Sometimes 

Armament  carried 

Yes 

No 

-'•Especially  true  if  audio  is  not  recorded. 
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Similar  comments  to  those  in  the  above  paragraph  apply  to  the 
deduction  of  routes  flown. 

The  equipment  on  board  can  be  deduced  from  the  associated  status 
word(s)  monitored  and  recorded  by  the  CSFDR,  although  thorough  examina¬ 
tion  of  the  wreckage  and  unclassified  literature  could  be  used  to  obtain 
the  same  information  in  may  cases.  Also,  through  an  accumulation  of 
status  word  information  over  a  period  of  time,  it  is  possible  that  the 
relative  reliability  of  various  aircraft  subsystems  could  be  deduced. 

Altitude  profiles  vs.  time  can  be  deduced  directly  from  CSMU  data. 

This  problem  is  particularly  critical  for  classified  aircraft. 

The  actual  numbers  of  aircraft  being  used  for  various  missions 
cannot  be  obtained  from  CSMU  data.  However,  if  audio  were  a  recorded 
parameter,  then  it  would  be  possible  to  deduce  numbers  of  aircraft  from 
the  recordings  of  airborne  radio  transmissions. 

Temporary  rendezvous  points  could  be  derived  if  they  were  within 
approximately  19.4  minutes  (Config.  II)  or  29.4  minutes  (Config.  I)  of 
flight  time  from  the  mishap  site.  These  points  could  be  derived  from 
airspeed,  altitude,  and  heading  information  or  velocity  and  altitude 
information . 

3. 2. 5. 2  Need  for  security  -  The  preceding  section  pointed  out  some 
of  the  needs  for  security  for  CSFDR  system  information.  In  addition  to 
the  above  rationale  presented  in  that  section,  there  are  two  other  needs 
for  security.  These  are 

•  Potential  application  to  classified  aircraft  and  RPVs 

•  Potential  tri-service  standardization 

Since  the  design  concept  preserted  in  this  study  is  for  a  standard  CSFDR 
system,  the  future  aircraft,  in  which  the  CSFDR  system  will  be  used,  are 
not  known  at  this  time.  Therefore,  it  is  conceivable  that  classified 
aircraft  and  RPVs  could  use  the  CSFDR  system.  Security  is  vital  to 
these  types  of  aircraft. 

Additionally,  llio  Navy  desires  security  for  its  airborne  recorded 
information.  Thus,  the  concept  of  the  tri-service  standardization 
dictates  that  security  be  considered. 

3 . 2 . 5 . 3  Pj) t ent i a  1_  me thods  of  preventing  or  minimizing  data  loss  to 
the  enemy  -  The  potential  methods  of  preventing  or  minimizing  data  loss 

to  the  enemy  are  shown  in  figure  24.  They  are  subdivided  into  operational, 
hardware,  software  methods,  and  documentation  methods. 
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a.  Operational  methods.  The  first  operational  method  which 
could  be  used  would  be  that  of  removing  the  CSMU  from  the  aircraft. 
However,  the  CSMU  is  not  as  accessible  as  the  MSU  of  Configuration  III. 
This  stems  from  the  fact  that  survivability  and  accessibility  are  usually 
conflicting  goals.  Moreover,  the  CSMU  is  a  very  small  and  light  unit 

and  does  not  pose  an  operational  penalty  in  these  areas.  Also,  the 
combined  person-hour  penalty  which  would  result  from  removal  and  reinstal¬ 
lation  would  be  significant.  Therefore,  the  removal  method  is  not 
recommended . 

Other  operational  methods  are  to  delete  security-sensitive  data  and 
to  limit  the  dynamic  range  of  certain  data  when  operating  near  or  over 
enemy  territory.  These  two  methods  require  additional  manual  inputs  to 
the  CSFDR  system  and  the  possibility  of  inadvertently  or  incorrectly 
applying  such  inputs  discourages  these  techniques. 

Similarly,  the  circuit  breaker  method  is  discouraged  since  it  may 
be  inadvertently  left  open  during  normal  peacetime  operations. 

Therefore,  none  of  the  operational  methods  is  recommended. 

b.  Hardware  methods.  The  first  potential  hardware  method  is 
that  of  a  bulk  erase  feature  within  the  CSFDR  system  readout  process. 

The  weakness  in  this  method  is  the  possibility  of  an  inadvertent  bulk 
erase  during  normal  readouts.  Similar  weaknesses  are  present  in  the 
self  destruct  (pyrotechnical/electrical)  method  and  the  secure  readout 
method  which  alters  the  data  if  it  is  not  accessed  properly. 

The  delayed  CSMU  record  technique  would  involve  storing  the  critical 
data  in  the  scratchpad  memory  and  inhibiting  transfer  to  the  CSMU  when 
operating  near  or  over  enemy  territory.  Again,  the  weakness  in  this 
method  would  be  the  possibility  of  inadvertently  changing  the  CSFDR 
system  to  and  from  the  inhibit  mode  when  it  is  not  desired  to  do  so. 

Also,  additional  hardware  is  required  to  perform  this  function. 

Therefore,  none  of  the  hardware  methods  is  recommended. 

c.  Software  methods.  The  first  software  method  discussed  is 
that  of  encryption.  Once  the  airborne  software  has  determined  that  data 
would  be  recorded  in  the  CSMU,  the  microprocessor  loads  this  data  into 
an  encryption  chip.  Here  the  data  is  encoded  and  returned  to  the  micro¬ 
processor  bus  within  several  microseconds.  Following  this  step,  the 
encoded  data  is  transmitted  to  the  CSMU.  Only  those  data  words  which 
have  been  determined  to  be  nonredundant  by  the  airborne  software  require 
encoding.  This  minimizes  the  impact  on  the  data  processing  functions. 

The  encoding  chips  are  explained  in  more  detail  in  the  next  section  and 
will  meet  the  Data  Encryption  Standards  defined  by  the  National  Bureau 
of  Standards.  Of  all  the  security  protection  techniques  reviewed,  this 
one  offers  the  most  promise  for  the  CSFDR  system,  and  is,  therefore,  the 
recommended  technique. 
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Another  software  method  is  that  of  coded  readout  commands.  In  this 
method,  the  CSMU  would  not  respond  unless  the  proper  encoded  readout 
commands  were  sensed  in  the  read/  write  electronics  of  the  CSMU.  This 
technique  is  not  recommended  for  the  CSFDR  system  because  the  CSMU  can 
be  disassembled,  thereby  permitting  the  read/write  electronics  to  be 
bypassed,  and  ultimately  a  direct  read  off  the  memory  chips  could  be 
made . 


A  third  software  method  is  that  of  using  coded  memory  locations  in 
the  CSMU.  This  technique  is  not  compatible  with  the  CSFDR  system  archi¬ 
tecture  and  is  not  recommended. 

The  final  software  method  considered  was  that  of  readout  erase. 

With  the  nonvolatile  solid-state  memories  selected  for  the  CSMU,  this 
technique  would  not  be  practical  or  effective. 

d.  Documentation  methods.  The  first  potential  method  of 
achieving  security  protection  via  documentation  methods  is  that  of 
controlling  all  CSFDR  system  documents.  This  technique  has  been  used 
effectively  for  avionics  systems  where  small  numbers  of  classified 
systems  were  involved.  However,  since  it  is  desired  to  use  the  standard 
CSFDR  system  on  many  aircraft,  this  method  would  be  awkward,  expensive 
to  implement,  and  would  probably  not  be  effective  over  a  long  time 
period . 

The  technique  of  controlling  only  the  hardware  documentation  would 
not  be  effective.  This  is  due  to  the  fact  that  the  CSMU  memory  map  and 
software  are  sufficient  to  reconstruct  the  parameter  profiles. 

Controlling  the  software  (both  airborne  and  ground-based)  documenta¬ 
tion  would  be  partially  effective.  Without  a  knowledge  of  the  data 
compression  software,  if  would  be  difficult  to  reconstruct  the  parameter 
profiles.  However,  is  must  be  remembered  that  not  all  flight  incidents 
are  catastrophic  in  nature,  and,  therefore,  the  DPU  may  survive  some 
incidents  over  enemy  territory.  Since  the  data  compression  program  is 
resident  in  the  DPU,  a  L)PU  which  survives  a  minor  incident  could  be  used 
to  extract  the  entire  airborne  software  program.  Thus,  controlling  the 
software  documentation  does  not  guarantee  security  of  the  actual  software 
program.  Therefore,  this  technique  is  only  recommended  as  an  alternate 
to  that  of  encryption. 

e.  Recommended  method.  The  easiest  and  most  effective  method 
of  securing  the  CSFDR  system  data  is  that  of  encryption.  The  micro¬ 
processor  selected  for  the  CSFDR  system  is  compatible  with  data  encryp¬ 
tion  techniques  and  these  techniques  have  minimal  hardware  and  software 
impacts  on  the  overall  system  design.  Moreover,  the  actual  code  used  is 
exceedingly  difficult  to  break  if  the  DES-type  algorithm  is  used.  It  is 
estimated  that  it  would  take  a  ground-based  mainframe  computer  approxi¬ 
mately  6  months  of  processing  time  to  break  the  DES-type  code. 
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Many  companies  have  developed  integrated  circuit  chips  to  implement 
the  NBS  DES.  Table  26  lists  the  manufacturer,  chip  nomenclature,  and 
rough  prices  for  the  chips,  in  production  quantities  required  for  the 
CSFDR  system. 


Table  26.  Summary  of  Survey  for  Data  Encryption  Devices 
Which  Meet  NBS  DES  Requirements 


MANUFACTURER 

CHIP  NOMENCLATURE 

APPROXIMATE  PRICE  PER  CHIP  ($) 

Burroughs 

MC884 

$40 

Fairchild  Semiconductor 

9414  set 

$30 

Intel 

8294 

$15 

Motorola 

MC6859 

$40 

Western  Digital 

WD2001 

2002 

$50  -  $100 

The  Motorola  MC6859  offers  great  promise  for  the  CSFDR  system 
application.  It  is  available  as  a  monolithic  IC  in  a  24-pin  DIP.  The 
device  is  already  designed  to  operate  in  conjunction  with  a  microprocessor. 
It  utilizes  an  8-bit  I/O  bus  and  a  12-bit  address/control  bus.  Additional 
ICs  are  required  to  adapt  this  device  to  the  CSFDR  microprocessor  and  it 
would  add  one-half  a  card  of  "real  estate"  to  the  CSFDR  system.  This 
added  "real  estate"  will  not  increase  the  size  of  the  unit,  however, 
since  this  expansion  capability  is  designed  into  the  CSFDR  DPU.  Actual 
security  of  this  approach  lies  in  the  key.  To  meet  the  DES,  a  64-bit 
word  is  scrambled  into  another  64-bit  word,  using  a  56-bit  key  to  deter¬ 
mine  the  coding.  The  multi-trillion  combinations  possible  by  this  key 
makes  decoding,  without  knowledge  of  the  key,  almost  Impossible.  However, 
the  MC6359  goes  one  step  further  in  that  it  uses  a  second  key  to  protect 
the  first.  In  this  two-key  system,  the  primary  key  is  used  to  encrypt 
the  secondary  key  and  the  secondary  key  is  used  to  encrypt  the  subsequent 
message.  This  technique  would  provide  the  needed  security  for  the  CSFDR 
system. 

In  summary,  we  recommend  the  software  technique  of  data  encryption 
as  the  technique  to  secure  the  CSFDR  system  data.  Additionally,  we 
recommend  a  two-key  system  for  encryption. 


206 


3.2.6  Data  readout  facility  -  The  data  readout  facility  and  its 
associated  equipment  represent  the  lowest  risk  portion  of  the  entire 
CSFDR  system  program.  Several  low  technology  risk  approaches  were 
uncovered  during  this  phase  of  the  study  and  these  approaches  include 
maximum  use  of  equipment  already  existing  within  the  USAF  inventory. 
Therefore,  the  output  of  this  phase  of  study  is  a  prioritized  ranking  of 
the  choices  available  to  the  USAF. 

3.2.6. 1  Ground-based  facilities  -  This  analysis  began  by  compiling 
a  list  of  feasible  facilities  for  CSFDR  system  readouts.  These  were: 

•  Norton  AFB  existing  EDP  center  and  special  interface 
equipment . 

•  Data  Transfer  System  ground  terminal,  located  at 
Norton  AFB,  and  special  equipment. 

•  Tinker  AFB  EDP  center  and  special  interface  equipment. 

•  NTSB  existing  readout  facility  and  special  interface 
equipment . 

•  Universal  Ground  Terminal  Unit  developed  for  ULAIDS, 
located  at  NAFB. 

These  facilities  were  analyzed  in  terms  of  minimum  cost  impact  to 
the  overall  CSFDR  system  program. 

a.  NTSB  facility.  Although  the  NTSB  facility  at  Washington 
D.C.  appeared  to  be  a  logical  choice  based  upon  past  history,  it  was 
immediately  eliminated  from  the  list  after  interviews  were  held  with  key 
NTSB  personnel.  There  are  four  basic  reasons  why  it  was  eliminated. 

(1)  The  NTSB  operates  under  the  strict  definition  of 
"transportation"  and  currently  reports  directly  to  Congress.  (In  the 
past,  the  NTSB  was  coupled  with  the  FAA  and  both  reported  to  the  Department 
of  Transportation.)  Military  operations,  which  include  training  missions, 
arid  delivery  of  military  hardware  do  not  fit  the  NTSB  classical  defini¬ 
tion  of  transportation  and  it  would  require  Congressional  approval  for 

the  NTSB  to  broaden  their  definition  of  transportation  to  include  military 
operations  on  a  full-time  basis. 

(2)  The  NTSB  is  currently  staffed  only  for  commercial 
accident  investigations.  The  higher  frequency  of  military  accidents 
would  require  an  expanded  staff,  especially  if  all  three  services 
requested  support. 
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(3)  Use  of  the  NTSB  rould  cause  potential  security 
problems  where  classified  missions/aircraft  were  involved  in  a  mishap. 

(4)  Due  to  the  nature  of  commercial  accident  investiga¬ 
tions  and  their  legal  aspects,  it  is  unlikely  that  the  legal  repre¬ 
sentatives  of  commercial  airlines  would  accept  simultaneous  services  to 
both  commercial  and  military  readouts. 

Based  upon  these  reasons,  we  eliminiated  the  NTSB  facility  as  a 
viable  readout  facility. 

b.  UGTU  facility.  The  Universal  Ground  Terminal  Unit  (UGTU) 
developed  for  the  Navy  ULAIDS  program  was  also  reviewed  for  applicability 
to  CSFDF.  system  readouts.  This  system  is  an  excellent  ground-based 
system  capable  of  processing  data  collected  by  various  Navy  airborne 
data  management  systems  and  includes: 

FIR  (tape  and  solid-state  memory)  Playback  Interface  Unit 
(PIU) 

AHMR  tape  PIU 

A-7E  Integrated  Engine  Condition  Monitoring  System  Tape  (IECMS) 
PIU 

F-18  Maintenance  Data  Recorder  Magazine  (MDRM)  PIU 
Data  entry/display  terminal 
Line  printer 
Computer 

Mass  storage  (2-1.2  million-word  disks) 

Tape  drive 

The  UGTU  was  also  eliminated  as  a  candidate  readout  facility  for 
the  following  reasons: 

(1)  With  the  one  exception  of  the  solio-state  FIR  PIU, 
the  UGTU  is  oriented  to  reading  out  airborne  tape  units  and  this  is  in 
conflict  with  the  recommended  CSFDP  approaches  which  are  all  solid-state 
memory  oriented. 

(2)  The  line  printer,  computer,  mass  storage,  and  tape 
drives  are  a  functional  duplication  of  similar  devices  in  the  USAF 
inventory  at  Norton  AFB,  and  Tinker  AFB. 
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Thus  the  Navy  UGTU  was  eliminated  as  a  viable  CSFDR  system  readout 
facility. 

The  remaining  three  candidate  facilities  are  all  feasible  and 
acceptable  for  the  CSFDR  system  configurations. 

c.  Norton  AFB  EDP  facility.  The  Headquarters  Air  Force 
Inspection  and  Safety  Center  is  located  at  Norton  Air  Force  Base, 
California.  Mishap  statistics  and  related  data  are  now  maintained  on 
file  at  the  Norton  EDP  center,  which  makes  this  facility  the  most  logical 
choice  for  CSFDR  system  readouts.  The  accumulated  CSFDR  system  data 
will  augment  the  existing  AFISC  data  base. 

The  Norton  EDP  facility  utilizes  a  standard  IBM  370/155  mainframe 
computer  and  standard  0S/VS1  operating  system.  Additionally,  this 
facility  services/ interfaces  EDP  centers  at  WPAFB,  Langley  AFB,  Tinker 
AFB,  Kelly  AFB,  and  many  other  AFBs .  Interface  with  other  safety  centers 
within  DOD  is  also  provided. 

The  primary  languages  now  used  at  Norton  are  Fortran  IV  and  COBOL. 
Both  of  these  languages  are  on  the  DOD  5000.31  approved  standard  language 
list.  Of  the  two  languages,  Fortran  IV  is  the  more  applicable  one  for 
the  readout  facility  software  required  to  support  the  CSFDR  systems. 
Therefore ,  all  of  the  ground-based  software  described  in  3. 3. 3. 4  will  be 
provided  in  Fortran  IV.  Additionally,  the  Norton  AFB  EDP  center  has  the 
capability  for  placing  the  mishap  data  on  a  secure  disk  file,  which  is  a 
highly  desirable  feature. 

The  only  additions  required  to  this  facility  are: 

(1)  The  Data  Processor  Retrieval  Unit  which  interfaces 
the  CSMU  with  the  370/155  mainframe  and  provides  three  levels  of  readout 
ccpability  (see  3.2.6.2.b) 

(2)  A  plotter  and  plotter  interface  unit  to  provide 
parameter  plots  as  described  in  3. 3. 3.4. 

(3)  A  ground  support  software  package  as  described  ir. 

3. 3. 3. 4. 

(4)  The  capability  to  make  the  area  secure  during  CSMU 

readouts . 

In  summary,  we  recommend  that  the  existing  EDP  facility  at  the 
NAFB,  with  the  above  additions,  be  considered  as  the  primary  ground 
readout  facility. 
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d.  Norton  AFB  DTS  facility.  In  the  event  that  the  USAF 
should  elect  not  to  use  the  IBM-370/155-based  EDP  facility  at  Norton,  an 
alternate  capability  designed  around  the  Data  Transfer  System  can  be 
located  at  Norton  AFB  for  CSFDR  system  readouts.  This  ground-based 
system  is  already  in  the  USAF  inventory  and  utilizes  a  standard  HP  1000 
series  general  purpose  computer  system.  This  system  includes  a  disk 
drive,  two  display  stations,  a  line  printer,  and  receptacles  for  Data 
Transfer  Modules.  The  same  additions  as  for  the  Norton  AFB  EDP  facility 
are  required  for  the  Norton  AFB  DTS  facility.  The  ground-based  software 
described  would  be  resident  on  the  HP-1000  and  would  be  written  in 
Fortran  IV.  This  system  is  described  in  reference  12. 

e.  Tinker  AFB  EDP  facility.  A  third  choice  for  the  readout 
facility  is  also  available  and  practical  for  CSFDR  system  readouts. 

This  is  the  existing  EDP  center  at  Tinker  AFB,  which  is  now  used  to 
process  the  ASIP  tapes.  These  tapes  contain  up  to  15  hours  of  flight 
data,  and  approximately  600  tapes  are  processed  each  month.  The  EDP 
center  uses  an  IBM-360/65  standard  system  with  card/tape/disk/printer 
and  controller  capabilities.  The  ASIP  tapes  now  processed  at  Tinker 
must  be  reformatted  (transcribed)  before  they  can  be  processed  on  the 
mainframe.  Tinker  AFB  represents  a  logical  choice  for  CSFDR  system 
readouts  because  of  the  tie-in  to  the  ASIP  functions  (configuration  III) 
and  their  interface  wiuh  Norton  AFB.  The  same  additions  would  have  to 
be  made  to  the  Tinker  facility  as  for  the  Norton  facility  to  provide 
full  CSFDR  system  readout  capability  since  a  plotter  is  not  currently 
available.  (Note:  The  Tinker  facility  is  being  updated  and  procurement 
of  a  plo'.rer  is  planned.  If  this  facility  is  selected  as  the  CSFDR 
system  readout  facility,  the  updated  facility  should  be  reviewed  and 
incorporated  into  the  CSFDR  program.) 

3. 2. 6. 2  Data  readout  hardware  description  -  Often  overlooked  in 
the  initial  stages  of  crash  recorder  design  are  the  requirements  for 
readout  at  various  levels  of  recorder  system  damage.  The  fact  that  the 
recorder  memory  media  survives  the  mishap  does  not  guarantee  a  direct 
readout  via  external  connectors.  There  are  many  cases  on  record  where 
the  recorder  had  to  be  literally  sawed  in  half  with  a  hack  saw,  or 
equivalent,  following  a  mishap,  in  order  to  retrieve  the  memory.  More¬ 
over,  the  external  connectors  are  frequently  damaged  mechanically  or 
thermally,  thereby  eliminating  a  direct  readout.  This  problem  is  not 
unique  to  the  USAF  CSFDR  system,  but  is  a  common  problem  in  basic  crash 
recorder  design.  We  have,  therefore,  chosen  to  divide  the  readout 
categories  into  four  basic  levels  as  follows: 


12LSI  brochure  entitled  "Shirt  Pocket  Precision:  The  LSI  Data 
Transfer  Syster",  LSI  Publication  No.  ID-028-0280. 


Level  I  -  CSMU  recovered  and  undamaged  -  readout  made  directly  via 
the  chassis  connector  on  CSMU. 

Level  II  -  CSMU  recovered  and  partially  damaged  -  readout  accom¬ 
plished  by  mechanically  connecting  to  the  internal  interconnect  of  the 
CSMU. 


Level  III  -  CSMU  recovered  and  damaged  externally  -  readout  made 
directly  via  the  memory  integrated  circuits  (ICs). 

Level  IV  -  DPU  and  CSMU  totally  intact  and  on  aircraft-readout 
made  directly  through  DPU  connector  without  removing  any  part  of  recorder 
system. 

These  methods  and  the  needed  equipment  are  described  in  the  next 
two  sections. 

a.  Level  IV  -  DPU  and  CSMU  intact  and  on  aircraft. 

This  method  of  readout  would  occur  following  a  minor  mishap  or  when 
a  non-catastrophic  incident  occurred  during  flight  and  was  followed  by 
corrective  actions  which  resulted  in  an  uneventful  landing.  In  these 
cases,  a  very  small  portable  unit  would  be  carried  out  to  the  aircraft 
for  data  retrieval . 

The  system  block  diagram  for  this  portable  Data  Retrieval  Unit 
(DRU)  is  shown  in  figure  25.  In  operation,  the  Data  Processor  Unit  on 
this  aircraft  recalls  the  data  from  the  Crash-Survivable  Memory  Unit 
(also  on  the  aircriit)  and  loads  it  into  the  Data  Transfer  Module  con¬ 
tained  in  the  rect  ptacle  of  the  DRU.  This  process  is  initiated  after 
the  cable  is  connected  and  the  START  push  button  is  depressed.  When  the 
microprocessor  in  the  DPU  receives  this  interrupt  its  normal  program 
will  be  halted  and  the  retrieval  program  will  be  executed.  The  micro¬ 
processor  illuminates  the  BUSY  indicator  lamp  on  the  DRU  to  inform  the 
operator  while  the  data  is  being  loaded.  A  BIT  procedure  is  incorporated 
to  read  each  word  back  from  the  DTM  and  compare  it  with  the  word  just 
loaded  to  check  integrity  of  the  Data  Retrieval  Unit.  A  bad  word  compare 
is  signaled  by  blinking  the  BUSY  indicator  lamp. 

The  Data  Retrieval  Unit  hardware  and  carrying  case  are  shown  in 
figure  26.  The  case  will  house  a  DTM  receptacle  and  provide  storage  for 
two  DTMs  which  are  already  in  the  Air  Force  inventory.  (See  reference  12 
for  information  on  DTM  hardware.)  The  interface  cable  is  stored  in  the 
cover  of  the  carrying  case.  Power  for  the  DRU  is  provided  by  the  Data 
Processor  Unit  via  the  standard  I/O  bus. 

This  method  provides  a  very  inexpensive  approach,  which  maximizes 
USAF  inventory  hardware,  to  provide  level  IV  type  readouts.  After  the 
data  has  been  loaded  into  the  solid-state  DTM,  it  can  be  mailed  to  any 
desired  USAF  facility  for  further  analysis. 
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igure  25.  Data  Retrieval  Unit  System  Block  Diagram 


The  min'.mum  cost  DRU  can  be  located  at  each  airbase  or  as  deemed 
necessary. 


b.  Levels  I,  II,  and  III  -  CSMU  Recovered  Separately.  The 
second  category  requires  a  more  comprehensive  machine  to  interrogate  the 
equipment  after  damage  has  occurred.  The  Data  Processor  Retrieval  Unit 
(DPRU)  would  be  located,  for  instance,  at  Norton  AFB. 

The  Data  Processor  Retrieval  Unit  system  diagram  is  shown  in  figure 
27.  This  aquipment  can  extract  data  from  the  CSMU  at  three  levels  of 
mishap  severity.  This  equipment  consists  of  a  Lear  Siegler  ADM-3A  CRT 
terminal,  the  DPRU  and  cable/interface  for  the  three  levels  of  interroga¬ 
tion.  The  operator  controls  the  hardware  functions  via  the  CRT  terminal. 

The  data  is  read  out  of  the  CSMU  by  the  DPRU  3nd  loaded  into  the  Data 
Transfer  Module  (DTM) .  After  data  retrieval  is  completed,  the  information 
can  subsequently  be  transferred  from  the  DTM  to  the  IBM  370  system. 

This  process  requires  that  the  data  be  recalled  from  the  DTM,  reformatted 
to  RS-232  and  transmitted  to  the  IBM-370  ground-based  system.  Now  the 
post-incident  analysis  can  be  carried  out  via  the  ground-based  system. 

Likewise,  any  DTM  sent  to  NAI'B  from  level  IV  readout  incidents  are 
plugged  into  the  DPRU  in  order  to  transfer  mishap  data  to  the  IBM-370  system. 

At  level  I  the  CSMU  is  intact  and  the  interface  cable  is  attached 
to  the  chassis  connector.  The  read  command  is  entered  on  the  CRT  terminal 
keyboard.  The  data  is  then  read  out  of  the  CSMU  and  loaded  into  the  DTM 
which  is  inserted  in  the  DPRU.  The  various  operations  at  the  three 
levels  of  interrogation  are  controlled  by  a  microprocessor  within  the 
DPRU.  In  order  to  achieve  the  maximum  degree  of  standardization  possible 
within  the  overall  CSFDR  system,  the  microprocessor  hardware  will  be 
identical  to  that  within  the  airborne  DPU. 

At  level  II  the  mechanical  connection  is  with  the  internal  circuit 
interconnect.  This  is  the  interface  to  the  read/write  1( gic  housed 
within  the  protected  subassembly.  The  data  interface  at  level  II  is 
still  serial  in  nature  with  approximately  ten  conductors  in  the  circuit 
interconnect . 

At  level  III  interrogation  is  directly  with  the  EE-PROM  memory  ICs. 

At  this  level  a  parallel  interface  must  be  provided  to  the  memory  ICs. 

There  are  several  ways  to  do  this.  One  way  is  to  remove  the  read/write 
logic  gate-array  from  the  memory  substrate.  Then  attach  it  to  the 
metalization  interface  of  the  memory  IC  array.  A  mechanical  substrate 
holder  is  used  to  connect  to  the  metalization  interconnect.  Another 
approach  is  to  remove  each  memory  IC  package.  Each  memory  IC  would  be 
read  individually  when  installed  in  a  mechanical  holder  that  connects  to 
the  package  leads.  The  data  processor  retrieval  unit  would  store, 
organize  and  then  load  the  information  into  one  or  more  DTMs.  Multiple 
copies  of  the  data  can  be  made  at  all  levels. 
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Note  that  this  approach  also  is  of  minimum  cost  because  the  DTMs 
are  in  USAF  inventory.  The  processor  resident  within  the  DPRU  is  identi¬ 
cal  to  that  of  the  airborne  DPU  thereby  reducing  processor  hardware  and 
software  design. 

3. 2. 6. 3  Prioritized  ranking  of  data  readout  facilities  -  Ranking 
of  potential  readout  facilities  is  as  follows: 

(1)  Norton  AFB  existing  EDP  center  with  DPRU  station  to 
provide  all  levels  of  readcjt. 

(2)  Data  Transfer  System,  stationed  at  Norton  AFB,  based 
upon  existing  USAF  inventory  HP-1000  system  and  DPRU  to  provide  all 
levels  of  readout. 

(3)  Tinker  AFB  existing  EDP  center  with  DPRU  station  to 
provide  all  levels  of  readout. 

Note  that  a  DPRU  is  required  in  any  case.  Also,  based  upon  a  review  of 
Ciass-A  mishaps,  it  is  envisioned  that  levels  I  and  II  would  be  the  most 
frequently  used  levels  of  readouts. 

3. 2. 6. 4  Data  readout  hardware  for  mass  memory  unit  -  Configuration 
III  requires  data  retrieval  hardware  to  transfer  information  from  the 
Mass  Storage  Unit  (MSU)  to  magnetic  tape.  This  hardware  consists  of  two 
pieces  of  equipment:  an  MSU  Data  Retrieval  Unit  and  a  Tape  Recorder 
Unit.  In  operation,  the  MSU-DRU  is  carried  out  to  the  aircraft  and 
attached  to  a  connector  rrovided  on  the  Data  Processor  Unit  (DPU).  The 
data  is  recalled  from  the  Mass  Storage  Unit  by  the  DPU  and  transmitted 
to  the  MSU-DRU.  The  Data  Retrieval  Unit  reformats  the  data  and  sends  it 
to  the  Tape  Recorder  Unit  for  recording. 
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3.2.7  Recommended  technical  approach  -  The  technical  approach  for 
CSFDR  system  design  recommended  in  this  section  is  based  upon  the  results 
of  sections  3.1  (determination  of  requirements),  3.2  (technical  approach), 
and  3.3  (areas  of  special  emphasis). 

There  are  five  primary  driving  functions  which  must  be  optimized  in 
order  to  assure  a  CSFDR  system  capability  for  A/F/T  aircraft: 

a.  Minimize  the  total  volume  (size)  of  the  CSFDR  system 
because  space  (real  estate)  is  at  a  premium  for  A/F/T  aircraft. 

b.  Minimize  the  total  weight  (including  all  cables,  brackets, 
and  CSFDR  components)  impact  to  the  aircraft  because  weight  is  also 
critical  for  A/F/T  aircraft. 

c.  Minimize  the  LCC  of  the  CSFDR  system. 

d.  Crash  protect  and  install  the  protected  memory  to  survive 
A/F/T  Class-A  mishaps. 

e.  Design  the  CSFDR  system  to  operate  throughout  the  high-g 
maneuvers  which  are  typical  of  A/F/T  profiles. 

These  driving  functions  are  satisfied  if  the  following  technical 
approach  is  taken. 

a.  Separate  the  ;  irvivable  memory  pack  from  the  remainder  of 
the  CSFDR  sytem  electronics. 

b.  Use  a  solid-state  memory  in  conjunction  with  state-of-the 
art  techniques  for  data  conversion/data  processing/data  compression. 

A  brief  discussion  of  how  this  technical  approach  will  satisfy  the 
primary  driving  functions  follows: 

Separating  the  survivable  memory  from  the  CSFDR  system  electronics 
minimizes  the  overall  weight  added  to  the  aircraft  because  the  sensor 
lines  need  only  to  run  to  the  processor  unit  arid  not  the  full  length  or 
width  of  the  aircraft.  For  example,  if  all  CSFDR  system  modules  were 
packaged  within  a  single  box  and  this  box  were  located  in  the  tail  cone, 
then  every  sensor  line  would  have  to  run  to  the  tail  cone.  The  technical 
approach  taken,  allows  the  processing  and  conversion  functions  to  be 
located  as  close  as  is  practical  to  the  sensors  and,  therefore,  eliminates 
long,  heavy  cables.  Ccnversely,  to  mount  a  single  unit  in  a  centralized 
fuselage  bay  to  save  wiring,  requires  more  recorder  size  and  weight  to 
achieve  satisfactory  survivability  rates. 
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Survivability  and  installation  are  also  improved  by  separating  the 
memory  from  the  processor.  This  follows  because  a  small  package  containing 
the  survivable  memory  chips  can  be  remotely  located  in  an  extremity  of 
the  aircraft,  and  it  is  an  established  fact  that  extremities  of  the 
aircraft  exhibit  greater  survivability  characteristics.  Additionally, 
it  is  easier  to  find  space  for  two  smaller  units  than  for  one  larger 
unit  on  A/F/T  aircraft.  This  is  especially  true  for  aircraft  like  the 
F-16. 


Use  of  a  solid-state  memory  is  also  critical  in  satisfying  the 
primary  driving  functions.  Solid-state  devices  allow  continual  operation 
of  the  CSFDR  system  through  high-g  maneuvers.  This  is  not  true  of 
electromechanical  type  recorders.  For  example,  "tape  bunching"  is  a 
common  problem  where  tape  units  are  installed  on  high  performance  aircraft. 
Experience  also  shows  that  many  tape  recorders  will  completely  cut  out 
during  a  +7-g  (or  greater)  maneuver.  Solid-state  memories  eliminate 
these  problems. 

The  LCC  is  also  minimized  by  going  to  solid-state  devices.  This  is 
a  direct  result  of  eliminating  the  reliability  problems  and  maintenance 
overhead  problems  associated  with  recorders  having  moving  parts.  Also, 
solid-state  memories,  when  used  with  data  compression  techniques,  permit 
a  smaller  overall  package. 

Table  27  shows  the  recommended  design  goals  of  each  configuration. 


218 


Table  27.  Characteristics  of  Configurations  I,  II,  and  III 

Completely  solid-state  system  -  Data  Processor  Unit  (DPU)  and 

Crash-Survivable  Memory  Unit 
(CSMU) 

Expanded  recording  functions  -  Via  Mass  Storage  Units  (MSU) 

CSMU  and  MSU  separable  from  DPU  -  Installed  as  single  unit  or  in 

combinations  of  DPU  plus  remotely 
located  memories 

Low-power  Crash-Protected  Memory  -  Very  low  power,  solid-state, 

(CPM)  non-volatile 

Microprocessor  controlled  -  Data  conversion,  processing,  and 

compression,  including  BIT 

CSMU  survivability  -  Per  recommended  A/F/T  crash- 

survivability  specification 


Characteristic 

DPU 

CSMU 

MSU 

TOTAL 

Size : 

I 

212  in3 

42  in3 

254  inJ 

II 

197  in3 

35  in3 

— 

232  in3 

III 

212  in3 

42  in3 

108  in3 

362  in3 

Weight: 

I 

8.4  lbs 

2.8  lbs 

— 

11.2  lbs 

II 

7.6  lbs 

2.4  lbs 

— 

10.0  lbs 

III 

8.4  lbs 

2.8  lbs 

6.0  lbs 

17.2  lbs 

Power : 

I 

40  wntts 

1  watt 

— 

41  watts 

II 

35  watts 

1  watt 

— 

36  watts 

III 

40  watts 

1  watt 

10  watts 

51  watts 

Average 

I 

— 

29  min 

— 

— 

Flight 

II 

— 

19  min 

— 

— 

Time 

Retained: 

III 

29  min 

15  hrs 

Memory 

I 

— 

131,072 

bits 

— 

131,072  bits 

Required : 

II 

— 

65,536 

bi  ts 

— 

65,536  bits 

III 

131,072 

bits 

256Kxl6  bits 

2C4Kxl6  bits 

Table  27.  Characteristics  of  Configurations  I,  II,  and  III  (Continued) 


Characteristic 

DPU 

CSMU 

MSU 

TOTAL 

MTBF :  I 

5,258  hrs 

63,613  hrs 

— 

4,856  hrs 

II 

5,580  hrs 

89,047  hrs 

— 

5,251  hrs 

III 

5,258  hrs 

63,613  hrs 

3,400  hrs 

2,000  hrs 

Maint.  I 

2.899  hrs 

0.204  hrs 

— 

3.103  hrs 

MN/HRS  II 

2.733  hrs 

0. 146  hrs 

— 

2.879  hrs 

per  III 

2.899  hrs 

0.204  hrs 

3.823  hrs 

6.926  hrs 

1000 

operating 

hours : 

Program  I 

3,140  WDS 

— 

— 

3,140  WDS 

Memory:  II 

3,000  WDS 

— 

3,000  WDS 

III 

3,400  WDS 

— 

— 

3,400  WDS 

Random  I 

2,000  WDS 

— 

— 

2,000  WDS 

Access  II 

2,000  WDS 

— 

— 

2,000  WDS 

Memory:  III 

2,000  WDS 

— 

-  -  “ 

2,000  WDS 
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3 . ? . 8  Reliability  and  maintainability 


3.2.8. 1  Reliability  -  A  reliability  analysis  was  performed  on  the 
Data  Processor  Unit  (DPU) ,  Crash-Survivable  Memory  Unit  (CSMU),  and  the 
Mass  Storage  Unit  (MSU)  which  are  a  part  of  the  CSFDR  system.  The 
results  are  summarized  in  table  28  for  all  configurations. 

A  mean  time  between  failures  (MTBF)  of  4856  hours  was  predicted  for 
the  Configuration  I  system  using  MIL-HDBK-217C  notice  1  in  an  airborne 
uninhabited  fighter  environment  with  an  ambient  temperature  of  71°C. 

Since  most  of  the  circuitry  is  existing  design,  actual  component  stress 
values  were  used  and  a  realistic  estimate  was  made  by  the  Thermal  Analysis 
Group  for  board  temperature  rises.  Military  temperature  range  components 
with  the  quality  factors  summarized  below  will  be  used: 

Resistors  and  capacitors  MIL-SPEC 

Semiconductors  (discrete)  JANTX 

Integrated  circuits  MIL-STD-883  Class  B 

Similarly,  the  MTBFs  for  Configuration  II  and  III  are  computed  to 
be  5251  hours  and  2000  hours,  respectively. 

3 . 2 . 8 . 2  Maintenance  concept 

a.  Configuration  I  and  II 

(1)  0-level  (flight  line)  maintenance.  The  Data  Processor 
Unit  maintains  a  modular  design  with  a  microprocessor  controlling  all 
the  functions.  This  allows  the  microprocessor  to  efficiently  and  compre¬ 
hensively  perform  a  self-test  check  on  the  DPU  hardware,  using  the 
built-in  test  (BIT)  subroutine.  The  microprocessor  can  also  interrogate 
the  CSMU  on  the  two-way  standard  I/O  bus  to  confirm  read/write  capability 
to  the  EE-PROM. 

Within  the  DPU,  the  analog  conversion  hardware  is  checked  by  including 
two  reference  voltage  inputs  on  the  analog  MUX  board.  The  BIT  subroutine 
commands  the  A/D  converter  to  sample  and  convert  these  positive  and 
negative  references  on  a  periodic  basis.  A  watchdog  timer  is  used  to 
detect  software  hangups  and  other  periodic-function  failures. 

A  BIT  failure  signal  is  provided  from  the  DPU  to  annunciate  the 
Master  Caution/Telelight  Panel  if  a  failed  condition  is  detected. 

Additional  failure  indicators  can  be  mounted  on  the  DPU  to  differentiate 
between  a  DPU  and  CSMU  failure.  This  BIT  capability  will  eliminate  the 
need  for  0-ievel  test  equipment. 
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Table  28.  CSFDR  System  Reliability  Prediction 


DPU 

F.R  x  10“6  hrs 

MTBF  (hrs) 

Conf.  I  &  TII 

190.20 

5257.62 

Conf.  II 

179.20 

5580.36 

CSMU 

Conf.  I  &  III 

15.72 

63613.23 

Conf.  II 

11.23 

89047.20 

MSU 

Conf.  Ill 

294.1 

3400.20 

CSFDR  Total 
Conf.  I 

205.92 

4856.25 

Conf.  II 

190.43 

5251.27 

Conf.  Ill 

500.02 

2000.00 
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(2)  I-level  (base  shop)  maintenance.  The  Data  Processor 
Unit  Test  Set  is  shown  in  figure  2P.  This  test  set  is  used  at  the 
intermediate  (I-level)  test  facility  to  fault  isolate  to  the  board 
level.  The  equipment  consists  of: 

•  CRT/keyboard  terminal 

•  Test  interface  board 

•  DPU  test  panel 

•  Cables  and  board  extractors 

The  test  operator  interfaces  with  the  test  set  via  the  CRT/keyboard 
terminal  and  switches  located  on  the  DPU  test  panel.  The  test  procedure 
is  semi-automatic.  The  operator  initiates  each  test  segment  and  waits 
for  a  GO/NO-GO  condition  response.  The  CRT  terminal  will  provide  visual 
display  to  indicate  modes  of  opertaion,  patterns  and  indications  of 
failure. 

The  Test  Interface  Board  plugs  into  a  card  slot  provided  in  the 
Data  Processor  Unit.  This  board  contains  a  Universal  Asynchronous 
Receiver  Transmitter  (UART)  to  interface  between  the  CRT  terminal’s 
RS-232  channel  and  the  microprocessor’s  parallel  data  bus.  The  PROM 
containing  the  self-test  program  (STP)  of  about  6K  words  is  located  on 
the  interface  board.  The  scratchpad  RAM  used  by  the  DPU  microprocessor 
while  executing  the  STP  is  also  contained  on  the  interface  board. 

The  DPU  Test  Panel  is  basically  a  sensor  simulator  and  digital 
wraparound  tester.  The  sensor  simulator  section  provides  analog  AC,  DC 
signals  and  discrete  inputs  to  the  DPU.  The  Test  Panel  provides  wraparound 
of  the  two  standard  I/O  bus  channels.  The  Test  Panel  receives  data  on 
one  of  the  standard  I/O  channels  and  wraps  around  to  the  A/C  data  bus 
(e.g.,  1553)  input.  A  circuit  board  in  the  test  panel  generates  the 
interface  needed  for  the  A/C  data  bus  channel. 

The  Crash-Survivable  Memory  Unit  (CSMU)  can  be  attached  to  a  working 
Data  Processor  Unit  for  test  purposes.  The  self-test  program  will 
exercise  the  EE-PROM  in  the  CSMU  by  read/writing  to  each  location.  The 
power  will  be  supplied  to  the  CSMU  separately  so  that  the  power  monitor 
in  the  CSMU  can  be  checked  by  the  DPU  Test  Panel  for  the  low  voltage 
condition.  The  CSMU  will  be  returned  to  depot  for  repair. 

(3)  Depot  level  maintenance.  The  depot-level  test 
equipment  will  include  the  following  items: 

•  Data  Processor  Unit  Test  Set 

•  Gen  Rad  2270  (analog  cards) 

•  Gen  Rad  1796A  (digital  cards) 

•  CSMU  Tester 
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Figure  28.  Data  Processor  Unit  Test  Set 


The  Data  Processor  Unit  Test  Set  (figure  28)  will  fault  isolate  any 
returned  DPU  to  the  board  level.  Automatic  Test  Equipment  (ATE)  will  be 
used  to  fault  isolate  the  DPU  circuit  cards  to  the  component  or  group  of 
components  level.  The  Gen  Rad  2270  ATE  is  used  to  fault  isolate  the 
analog  cards.  The  digital  cards  are  fault  isolated  using  the  Gen  Rad 
1796A  ATE. 

The  CSMU  Tester  is  shown  in  figure  29.  This  equipment  has  been 
previously  proposed  for  depot  level  testing  of  a  similar  product,  the 
Data  Transfer  Module.  The  CSMU  Tester  is  a  semi-automatic  test  station 
providing  all  required  power  and  signals  to  operate  and  exercise  the 
CSMU.  The  tester  also  provides  visual  display  to  indicate  modes  of 
operation,  patterns  and  indications  of  failure. 

The  tester  is  made  up  of  the  following  items  which  are  depicted  in 
figure  29. 

Item  2  -  Computer,  Data  General  NO'^A  4/S 

Item  3  -  Terminal,  LSI  ADM  3A 

Item  4  -  Interface  Panel  Assembly 

Item  5  -  Diskette  Subsystem,  Data  tenoral  6030 

Item  6  -  CSMU  Adapter  Assembly 

Item  7  -  Digital  Interface  Board  (DIB)  Adapter  Assembly 

Item  8  -  Oscilloscope,  Tektronix  Model  433,  Mod  703K 

b.  Configuration  III.  In  Configuration  III  the  DPU  and  CSMU 
maintenance  concepts  are  the  same  as  for  Configurations  I  and  II. 
Maintenance  of  the  MSU,  at  each  level,  will  be  handled  in  a  manner 
similar  to  that  of  the  CSMU. 


CSMU  Tester 


3.3  rtreas  of  special  emphasis 


3.3.1  Memory  technology  survey  -  In  order  to  coraplete  the  memory 
technology  survey,  potential  candidates  for  the  data  storage  medium  were 
divided  into  three  basic  groups: 


( 1 )  Electromechanical 


Oscillographic 
Digital  tape 
Disc 
Drum 


( 2 )  Nonsolid-state 
electronic 


Core 

Plated  wire 


(3)  Solid-state 
electronic 


MNCS  EAROM 

NMOS  (static) 

MNOS  BORAM 

NMOS  (dynamic) 

MNOS/SOS 

MNOS  EE-PROM 

TTL  (static) 

NMOS  EE-PROM 

I2L  (static) 

PMOS  (static) 

I3L  (static) 

VMOS 

CMOS 

ECL 

CMOS/SOS 

CCD 

Bubble 

In  the  initial  stages  of  the  memory  technology  survey,  all  of  the  above 
technologies  were  considered  as  potential  candidates  in  order  to  elimi¬ 
nate  any  possible  bias  towards  a  particular  technology.  Characteristics 
associated  with  each  of  these  technologies  are  given  in  table  32. 

3.3. 1.1  Electromechanical  group  -  Four  basic  electromechanical 
technologies  are  considered  in  this  group:  1)  oscillographic,  2)  digi¬ 
tal  tape,  3)  disc,  .ind  4)  drum.  The  first  two  technologies  are  cur¬ 
rently  used  in  crash  recorders  for  transport,  cargo,  and  patrol  aircraft. 

a.  Oscillographic.  Oscillographic  recording  technology  is 
currently  used  in  crash  survivable  flight  data  recorders  for  inter- 
mediate-sized  aircraft.  These  recorders  are  generally  designed  to  ARINC 
Characteristic  No.  54213  entitled  "Airborne  Oscillographic  Flight  Data 


13ARINC  Characteristic  No.  542,  "Airborne  Oscillographic  Flight  Data 
Recorder",  Aeronautical  Radio,  inc. 
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Recorder",  and  meet  the  crash-survivability  requirements  of  FAR  37.150, 
TS0-C51a14. 

The  basic  concept  of  oscillographic  recording  is  shown  pictorially 
in  figure  30.  A  metal  foil  is  used  to  minimize  the  amount  of  heat  pro¬ 
tection  required  and  the  foil  is  usually  coated  with  a  thin  layer  of 
high  temperature  opaque  adhesive  to  provide  a  good  contrast  of  the  re¬ 
corded  information.  The  recording  styli  remove  ("scratch")  the  coating 
thereby  engraving  the  value  of  the  parameter  on  the  metal  foil.  The 
styli,  or  scribers,  are  driven  by  the  actual  sensor  signals.  Time  is 
automatically  provided  by  time  scribes  or  perforations  based  upon  a 
constant  rate  drive  of  the  foil.  Including  time,  recorders  using  this 
technology  record  at  least  five  parameters,  aid  seme  variations  have  an 
expanded  recording  capacity  of  up  to  ten  parameters.  An  additional 
requirement  of  recorders  using  this  technology  is  that  the  metal  foil 
and  associated  magazine  be  easily  replaceable  and/or  removable  because 
of  the  limited  recording  time  and  necessary  replenishment  of  the  foil 
itself.  Table  29  shows  the  maior  characteristics  associated  wi'.h  recor¬ 
ders  utilizing  oscillographic  technology. 


Table  29.  Characteristics  of  Typical  Oscillographic  Recorders 


Size 

1/2  ATR  long  (4.88"xl9.52"x7.62") 

(726  cubic  inches) 

Weight 

18  -  25  pounds 

Operating  temperature 

-55°  to  +70°C 

Recording  time 

200  -  400  hours 

Number  of  parameters 

5  basic  (time,  pressure  altitude, 
vertical  acceleration,  airspeed, 
heading)  expandable  to  10 

Type 

Non-ejectable  (type  I  or  type  II) 

Service  life 

1000  hours  minimum  for  electrical 
and  mechanical  assemblies 

Approximate  cost 
(low  quantity) 

$15,000 

14U.S.  Federal  Aviation  Regulation,  Part  37.150,  "Aircraft  Flight 
Recorder",  TS0-C51  a. 
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Basic  Concept  of  Oscillographic  Recording 


The  oscillographic  recording  technology  does  have  some  advantages. 
First,  the  coated  metal  foil  used  can  withstand  temperatures  well  beyond 
that  of  semiconductor  memories  thereby  minimizing  the  amount  of  heat 
protection  required  to  withstand  a  post-crash  fire.  There  is  also  some 
inherent  protection  from  mechanical  and  thermal  damage  due  to  the  con¬ 
centric  layers  of  the  foil  itself.  Moreover,  the  time  at  which  a  cata¬ 
strophic  incident  takes  place  will  be  easily  identified  on  the  foil  and 
markings  beyond  this  point  can  be  ignored  in  the  readout  process. 

Finally,  it  is  important  to  note  that  this  1  “"rding  technology  is  fully 
developed  and  has  been  used  in  over  500  accident  investigations  related 
to  commercial  airlines. 

However,  this  recording  technology  is  not  suitable  for  the  A/F/T 
aircraft  category.  Size  and  weight  are  excessive,  only  a  limited  number 
of  parameters  can  be  recorded,  it  is  not  easily  reprogrammable,  it  has  a 
lelatively  low  reliability  because  of  the  many  moving  parts,  the  foil 
must  be  replenished  frequently,  it  cannot  be  relied  upon  to  record 
faithfully  during  high  g  maneuvers  when  recording  is  extremely  important 
for  A/F/T  aircraft,  it  has  relatively  "sluggish"  data  transfer  rates, 
and  it  has  a  high  maintenance  overhead  penalty.  The  high  maintenance 
penalty  is  associated  with  foil  replacement,  check  and  calibration  of 
styli,  lubrication  of  moving  parts,  and  replacement  of  worn  parts. 

b.  Digital  Tape.  Digital  tape  recording  technology  is  also 
currently  used  in  crash-survivable  flight  data  recorders.  This  technology 
is  used  on  all  wide-bodied  commercial  aircraft,  some  large  military 
aircraft,  and  some  narrow-bodied  commercial  aircraft.  Recorders  using 
this  technology  are  generally  referred  to  as  digital  flight  data  recorders 
(DFDRs)  and  are  designed  to  ARINC  Characteristic  No.  54 1 1 5  entitled 
"Airborne  Magnetic  Flight  Data  Recorder"  and  meet  the  crash  survivability 
requirements  of  FAR  37.150,  TSO-051a.  Parameters  recorded  by  the  DFDRs 
are  identified  in  ARINC  Characteristic  57 3 - 7 1 6  entitled  "MARK  2  Aircraft 
Integrated  Data  System  (AIDS  MARK  2)".  Additionally,  the  DFDRs  are  used 
in  a  recording  system  configuration  employing  a  flight  data  acquisition 
unit  to  access  analog  data  from  aircraft  sensors  and  transmitters  and 
convert  the  data  to  digital  form  for  transmission  to  the  DFDR. 

The  basic  concept  of  crash-protected  digital  tape  recording  is 
shown  in  figure  31.  A  metal  tape  ("Vicalloy")  is  used  to  minimize  the 
amount  of  heat  protection  required  and  temperatures  in  the  proximity  of 
650°C  can  be  experienced  by  the  tape  without  a  total  loss  of  recorded 
data . 


15ARINC  Characteristic  Nc.  541,  "Airborne  Magnetic  Flight  Data 
Recorder",  Aeronautical  Radio,  Inc. 

16ARINC  Characteristic  No.  537-7,  "Mark  II  Aircraft  Integrated  Data 
System",  Aeronautical  Radio,  Inc. 
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A  typical  DFDR  can  record  over  25  hours  of  data  before  writing  over 
previously  recorded  data.  Multiple  track  tapes  are  used  to  achieve  the 
25-hour  requirement.  For  example,  a  si.c-traek  tape  will  record  over 
4  hours  of  data  on  each  track  before  rewriting  in  an  old  track.  In  this 
case,  tracks  1,  3,  and  5  would  be  recorded  in  the  forward  direction  and 
tracks  2,  4,  and  6  in  the  reverse  direction.  After  all  six  tracks  have 
been  used,  and  more  than  25  hours  of  data  have  been  stored,  recording  is 
resumed  on  track  1,  erasing  the  old  data.  Four-track  tape  units  are 
also  frequently  used,  but  in  either  case,  the  requirement  to  store  the 
last  25  hours  of  data  at  the  rates  specified  in  ARINC  541  implies  a 
storage  capacity  of  69xl06  bits  or  greater. 

Typical  DFDRs  require  an  FDAU  which  generates  the  timing  signals 
required  to  define  bit,  word,  subframe,  and  frame  times. 

Each  frame  of  data  contains  four  subframes,  and  each  subframe  con¬ 
tains  64  12-bit  bytes  representing  one  second  of  digital  data.  The 
first  word  of  each  subframe  is  a  synchronization  word,  provided  by  the 
FDAU,  and  this  word  signals  the  start  of  a  new  subframe.  The  FDAU  also 
converts  the  data  to  a  Harvard  Bi-phase  format,  and  transmits  it  to  the 
DFDR  in  a  serial  form. 

DFDRs  typically  have  the  transport  contained  within  an  enclosure 
constructed  to  protect  the  tape  against  crash  environments.  However, 
the  capstan  motor  is  mounted  outside  the  thermal  insulation  to  prevent 
motor  heat  from  destroying  the  transport.  In  the  early  days  of  crash 
recorders,  prototype  recorder  memories  were  occasionally  destroyed  due 
to  the  internal  heat  generation  of  the  motor  itself.*  Thermal  expansion/ 
contraction  problems  are  solved  by  using  compatible  materials.  For 
example,  mechanical  housing  and  and  shafts  are  constructed  of  compatible 
material  to  maintain  adjustment  throughout  the  operating  temperature 
range.  Table  30  shows  the  major  characteristics  associated  with  crash- 
protected  recorders  utilizing  digital  tape  technology. 

Including  time,  DFDRs  typically  record  at  least  18  parameters  and 
some  variations  have  an  expanded  recording  capacity  of  up  to  30  param¬ 
eters.  (One  variation  found  had  a  capacity  of  up  to  110  parameters.) 

An  internal  status  monitoring  capability  for  indicating  when  inadequate 
power  is  being  received,  and  a  means  for  preflight  checking  of  the 
recorder  for  proper  tape  movement  are  generally  provided.  Cooling  is 
usually  provided  by  a  combination  of  radiation  and  convection  from 
outside  surfaces.  Forced  air  cooling  is  usually  not  employed  by  DFDRs 
because  of  the  dust  problems  it  creates  with  respect  to  the  moving  parts 
and  forced  air  cooling  of  the  outer  surface  is  usually  not  required. 


*This  is  a  classic  problem  in  crash  recorder  design.  The  require¬ 
ment  to  crash-protect  the  memory  creates  a  double  problem  with  respect 
to  the  insulation  technique  used.  The  memory  must  be  insulated  well 
enough  to  survive  a  post-crash  fire,  but  it  must  also  allow  for  heat 
dissipation  during  normal  operation. 
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Table  30.  Characteristics  of  Typical  DFDR 


Size 

1/2  ATR  long  (4 . 88"xl9 . 52"x7 .62" j 
(726  cubic  inches) 

Weight 

20  -  25  pounds 

Operating  temperature 

-55°  to  +70°C 

Recording  time 

25  hours  or  greater 

Number  of  parameters 

18  -  20  (expandable  to  110) 

Storage 

69xl06  bits  or  greater 

Service  life 

1000  hours  minimum  for  electrical 
and  mechanical  assemblies 

Format 

Harvard  Bi-phase 

Track  density 

1600  -  1800  bpi  per  track 

Tape  speed 

0.43  -  0.46  inches/second 

BIT  error  rate 

-3  -4 

10  J  to  10 

Recording  medium 

Mylar  magnetic  tape  or  "Vicalloy" 
metal  tape 

Separate  FDAU 

1/2  ATR  long,  15  -  20  pounds 

Approximate  cost 
(low  quantity) 

$15,000  for  recorder 
$10,000  for  FDAU 
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Since  DFDRs  require  periodic  maintenance  actions  to  check  the 
recording  quality,  clean  the  read/write  heads,  clean  the  tape,  and 
extract  data  approximately  every  500  hours,  the  maintenance  overhead  for 
these  units  is  considerable,  although  not  as  high  as  the  maintenance 
overhead  for  oscillographic  recorders.  Data  monitoring  outputs  of  DFDRs 
help  to  reduce  the  maintenance  overhead. 

The  digital  tape  technology  does  offer  some  advantages  for  crash 
survivable  recording  systems.  As  with  oscillographic  recorders,  the 
recording  medium  can  withstand  temperatures  well  beyond  that  of  other 
memory  media  thereby  minimizing  the  amount  of  heat  protection  required 
to  withstand  a  post-crash  fire.  Concentric  layers  of  tape  provide  some 
mechanical  and  thermal  protection.  Memory  expansion  is  relatively 
inexpensive  (about  0.001  to  0.007  cents/bit)  thereby  permitting  an  ex¬ 
panded  parameter  list  potential  at  a  very  low  cost.  Also,  the  time  at 
which  a  catastrophic  event  takes  place  will  be  easily  identified  on  the 
tape  and  the  possibility  of  writing  over  pre-accident  information  is 
remote.  Finally,  it  is  important  to  note  that  this  recording  technology 
is  fully  developed  for  crash-survivable  recording  and  has  been  used  in 
accident/mishap  readouts  with  excellent  success  world  wide. 

Although  smaller  and  lighter  DFDR  systems  are  being  offered,  this 
technology  is  not  suitable  for  the  A/F/T  aircraft  category.  Size  and 
weight  are  excessive.  The  device  has  a  relatively  low  reliability 
because  of  the  moving  parts,  the  tape  must  be  replaced  periodically  when 
recording  quality  degrades,  it  cannot  be  relied  upon  to  record  faith¬ 
fully  during  high-g  maneuvers  when  recording  is  extremely  important  for 
A/F/T  aircraft*,  and  it  has  a  high  maintenance  overhead  penalty.  The 
maintenance  overhead  penalty  stems  from  the  need  to  continually  check 
recording  quality,  clean  the  read/write  heads,  clean  the  tape,  lubricate 
the  moving  parts,  extract  data,  and  replace  worn  tapes  and  parts. 

c.  Disc.  Disc  memory  systems  are  not  currently  used  for 
crash-survivable  flight  data  recorders.  However,  one  vendor  surveyed 
offers  a  very  small  airborne  memory  disc  which  could  be  made  crash- 
survivable.  This  airborne  memory  disc  is  currently  used  on  several 
intermediate-sized  and  wide-bodied  commercial  aircraft.  It  is  also  used 
on  one  fighter  aircraft  in  the  USN  inventory.  The  disc  also  meets  a 
wide  range  of  military  specifications  including  operating  temperature, 
power,  shock,  vibration,  altitude,  sand/dust,  salt  spray,  humidity,  and 
F.MI  . 


‘■'•'Experience  with  DFDRs  installed  in  high  performance  military 
aircraft  for  foreign  countries  shows  that  tape  bunching  during  high-g 
maneuvers  is  a  very  common  problem. 
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The  concept  of  how  this  disc  memory  system  would  be  used  for  the 
crash-survivable  flight  data  recorder  is  shown  in  figure  32.  Parallel 
data  is  transferred  bidirectionally  across  the  standard  memory  bus  under 
control  of  the  data  processing  electronics.  Disc-related  electronics 
are  functionally  divided  into  1)  the  required  interface  logic  for  bi¬ 
directional  transfer  of  parallel  data,  control  lines,  and  status  lines, 

2)  serial-to-parallel/parallel-to-serial  code  conversion,  data  format¬ 
ting,  and  error  detection,  and  3)  read/write  and  memory  select  circuitry. 
Storage  is  on  the  small  plated  disc  which  utilizes  fixed  heads  for 
surface  magnetization  and  magnetization  detection.  A  common  power 
supply  would  drive  the  recording  system  elements.  High  density  storage 
is  achieved  via  a  microscopically  thin  nickel-cobalt  alloy  on  an  alum¬ 
inum  substrate.  Characteristics  of  a  projected  crash-protected  disc 
system  utilizing  this  technology  are  shown  in  table  31. 

The  digital  disc  technology  would  offer  some  advantages  for  the 
CSFDR  system.  The  read/write  access  time  is  in  the  10-millisecond  range 
and  is  therefore  considerably  faster  than  typical  tape  units.  This 
access  time  is  comparable  to  the  write  cycle  access  time  associated  with 
MNOS  solid-state  memories  and  therefore  is  compatible  with  digital  data 
compression  techniques.  Also,  the  reliability  of  the  disc  system  is 
expected  to  be  very  good  (approximately  10,000  hours),  due  to  1)  the  use 
of  extremely  low  mass  heads,  2)  tough  coatings  over  the  smoothest  sur¬ 
face,  3)  massive  gyro  precision  bearings,  and  4)  hermetically  sealed 
enclosure.  Also,  the  capability  for  54  minutes  of  continuous  recording 
is  attractive.  Finally,  the  endurance  of  the  disc  media  is  an  excellent 
characteristic  for  the  A/F/T  application,  with  the  disc  life  exceeding 
the  aircraft  life  itself. 

However,  because  of  the  numerous  disadvantages  of  the  disc  system 
for  the  A/F/T  problem,  we  do  not  recommend  this  technology.  The  volu¬ 
metric  storage  density  is  only  about  25K  bits/cubic  inch  as  compared  to 
about  100K  bits/cubic  inch  for  tape  units.  Also,  the  disc  system  is  an 
electromechanical  device  requiring  periodic  maintenance  actions.  Addi¬ 
tionally,  the  cost  of  the  disc  system  would  be  relatively  high  when 
compared  to  other  systems,  the  size  of  465  cubic  inches  is  too  large, 
the  weight  of  15  pounds  is  too  heavy,  and  the  survivability  rate  of  the 
disc  is  not  expected  to  be  as  good  as  other  memory  media  for  the  A/F/T 
application.  Finally,  it  is  important  to  note  that  the  disc  memory  now 
in  production  has  the  motor  mounted  in  the  disc's  center  and  therefore 
would  have  to  be  redesigned  for  the  A/F/T  application.  This  redesign  is 
due  to  the  high  power  of  the  motor  and  the  two-way  insulation  problem 
associated  with  crash  recorders  in  general. 
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Table  31.  Projected  Characteristics  of  a  BFDR  Utilizing  Disc  ctorage 


Size 

1/2  ATR  short  (4.88"xl2.52"x7.62") 

(465  cubic  inches) 

Weight 

15  pounds 

Operating  temperature 

-54°  to  +71°C 

Recording  time 

0.905  hours  (54.3  minutes) 

Number  of  parameters 

18  -  30  (expandable  to  110) 

Storage 

2.5xl06  bits 

Service  life 

3000  hours 

Format 

Serial 

Density 

6000  bpi 

Disc  speed 

6000  rpm 

Bit  error  rate 

10_/ 

Recording  medium 

Cobalt-nickel  alloy  disc 

Data  transfer  rate 

10xl06  bps 

Approximate  cost 
(low  quantity) 

$15,000  -  $20,000 

Figure  32.  Memory  Disc  System  Used  for  Flight  Data  Recording 


d.  Drum.  Drum  memory  systems  are  not  currently  used  for 
CSFDRs,  but  are  ideal  for  situations  where  large  stores  of  information 
must  be  available  for  reading,  concurrent  with  input  of  enormous  quan¬ 
tities  of  data  for  processing.  Drum  memory  systems  are  used  on  the  USN 
S-3A  and  P-3C  aircraft.  They  are  also  used  on  the  AWACS  and  B-l  aircraft. 
None  of  these  units  are  crash-protected.  Drum  memory  systems  have  been 
used  on  high  performance  aircraft  such  as  the  A-6  and  F-lll.  The  results 
have  been  discouraging  in  the  areas  of  reliability,  maintainability,  and 
performance  through  high  g  maneuvers  because  of  the  inherent  electro¬ 
mechanical  nature  of  the  drum  system.  Fifteen  megabit  drum  systems 
using  a  cobalt-nickel  finish,  packaged  in  a  single  ATR  long  configura¬ 
tion,  and  meeting  military  specifications,  have  been  delivered.  These 
units  would  have  to  be  repackaged  to  meet  crash  survivability  specifi¬ 
cations.  Utilizing  such  repackaged  units  for  the  A/F/T  application 
would  result  in  severe  penalties  in  the  following  areas: 

•  s  ize 

•  weight 

•  initial  cost 

•  LCC  (because  of  high  R  and  M  costs) 

Moreover,  no  major  technological  advances  are  known  at  this  time  that 
would  significantly  improve  these  critical  areas.  Size,  weight,  and 
costs  would  have  to  be  reduced  by  a  factor  of  two  for  the  A/F/T  ap¬ 
plication.  Therefore,  we  do  not  recommend  this  memory  technology  for 
the  CSFDR  system. 

3.3. 1.2  Nonsolid-state  electronic  group  -  Two  basic  memory  tech¬ 
nologies  are  considered  in  this  group:  1)  core,  and  2)  plated  wire. 

a.  Core.  Magnetic  core  memories  have  been  considered  for 
severe  environment  flight  recorders  in  the  past17.  Previously,  this 
technology  has  continued  to  be  more  cost  effective  and  more  reliable 
than  many  challenging  technologies.  This  has  been  due  to  improvements 
in  cores,  planar  stack  design,  and  semiconductor  sense/drive  circuits. 

In  military  applications,  where  volatility  is  a  major  concern  (this  is 
especially  true  for  the  CSFDR),  magnetic  core  has  offered  the  most 
viable  approach  for  RAM  where  semiconductor  with  battery  backup  is  not 
acceptable.  Other  advantages  of  core  include  fast  access  time,  fast 
write  cycle  time,  infinite  data  retention,  and  infinite  endurance. 

However,  the  size,  weight,  and  operating  power  requirements  for  a  crash- 
protected  core  memory  system  would  consume  the  major  portion  of  the 
budgets  assigned  to  these  parameters  for  the  entire  CSFDR  system.  Note 
the  following  data  for  a  projected  4Kxl6-bit  crash-protected  core  memory 
system: 


17Trageser,  James  H.,  "Non-Volatile  Memory  System  for  Severe  Envi¬ 
ronment  Flight  Recorders",  Technology,  Inc.,  Dayton,  Ohio,  May  18,  1978. 
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Operating  Power 

Size 

Weight 


68  watts 

150  cubic  inches 
8  pounds 


The  operating  power  number  becomes  particularly  bad  for  this  application 
when  the  two-way  insulation  problem  is  superimposed  onto  the  design. 
Additionally,  the  cost/bit  of  approximately  5  cents  for  core  memory 
systems  is  not  particularly  attractive.  Thus,  we  do  not  recommend  core 
memory  technology  for  the  CSFDR  application. 

b.  Plated  Wire.  Plated  wire  is  one  of  a  very  few  memory 
technologies  which  has  exhibited  nonvolatile  storage  capabilities  during 
circumvention.  For  this  reason  it  has  historically  been  an  excellent 
candidate  for  memory  system  applications  requiring  radiation  haidening. 
However,  with  a  memory  system  cost  of  approximately  80  cer.ts/bit  it 
cannot  be  considered  as  a  viable  candidate  for  the  CSFDR  system. 

3. 3. 1.3  Solid-state  electronic  group  -  Seventeen  solid-state  elec¬ 
tronic  memory  technologies  were  reviewed  for  application  to  the  crash 
survivable  memory  portion  of  the  CSFDR  system.  Five  of  these  technolo¬ 
gies  were  found  to  be  viable  candidates. 

All  of  the  solid-state  electronic  memory  technologies  reviewed  are 
briefly  described  in  the  following  paragraphs. 

a.  MNOS  (metal-nitride-oxide-semiconductor).  MNOS  devices 
are  solid-state  memories  which  can  retain  stored  data  when  power  is 
removed.  They  can  be  erased  and  programmed  by  applying  an  electrical 
pulse  of  about  25  to  30  volts  to  the  programming  pins  without  wiping  out 
tiie  rest  of  the  memory. 

These  devices  are  relatively  slow  in  the  write  cycle18  and  have 
costs  (in  the  hybrid  configurations)  which  range  between  those  of  core 
memory  and  plated  wire.  Since  they  provide  almost  infinite  store  times, 
they  have  become  popular  in  a  host  of  new  applications  where  non-volatile 
devices  are  required.  The  hybrid  MNOS  EAROM  memory  systems  are  avail¬ 
able  from  several  sources  with  excellent  system  bit  densities. 

MNOS  technology  is  similar  to  that  of  typical  P-channel  MOS  trans¬ 
istors.  The  major  difference  is  the  nitride  layer  placed  above  the  gate 
region  between  the  gate  metal  and  oxide  layer.  Figure  33  indicates  the 
cross  section  of  an  MNOS  transistor. 

18Hnatek,  Eugene  R. ,  "An  Overview  of  Advanced  LSI  Technology", 
Monolithic  Memories,  Inc.,  Sunnyvale,  California,  i 9 7 7 . 
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Figure  33.  MNOS  Cross  Section 


The  function  of  the  nit-ide  layer  is  to  provide  the  ability  to  vary  the 
threshold  voltage  of  the  transistor.  The  variation  in  threshold  voltage 
is  accomplished  by  trapping  a  positive  or  negative  charge  in  the  nitride 
layer  by  application  of  a  write  or  clear  voltage  to  the  gate.  Applica¬ 
tion  of  a  clear  voltage  (typically  25  to  30  volts  positive)  results  in 
movement  of  a  negative  charge  from  the  substrate  into  the  nitride  layer. 
This  has  the  effect  of  reducing  the  magnitude  of  the  negative  voltage 
which  must  be  applied  to  the  gate  to  turn  the  transistor  on.  Applica¬ 
tion  of  a  write  voltage  (typically  25  to  30  volts  negative)  has  the 
opposite  effect,  i.e.,  movement  of  a  positive  charge  from  the  substrate 
into  the  nitride  layer  which  increases  the  magnitude  of  the  negative 
voltage  which  must  be  applied  to  the  gate  to  turn  the  transistor  on. 

Both  the  nitride  layer  and  oxide  layer  are  insulators.  However,  the 
write  or  clear  voltage  amplitude  is  sufficiently  great  to  effectively 
break  down  the  oxide,  allowing  the  charge  to  move  into  the  nitride 
layer.  Once  there,  it  remains  trapped  until  application  cf  a  write  or 
clear  voltage,  thereby  providing  the  non-volatility  characteristics  of 
an  MNOS  transistor.  When  used  as  a  memory  cell,  the  shift  in  threshold 
voltage  is  used  to  designate  a  logic  "zero"  or  "one". 
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One  excellent  quality  of  MNOS  memories  for  the  CSFDR  system  applica¬ 
tion  is  the  ability  of  these  devices  to  retain  data  for  long  periods  of 
time  at  elevated  temperatures11.  This  is  a  requirement  because  the 
survivable  memory  module  must  be  able  to  withstand  the  elevated  tempera¬ 
tures  encountered  in  a  post-crash  fire  while  utilizing  a  minimum  amount 
of  insulation.  (The  minimum  insulation  is  required  in  order  to  keep  the 
overall  size,  weight,  and  cost  as  low  as  possible.)  Retention  testing 
of  MNOS  LSI  memories  has  been  studied  in  great  detail.  Retention  times 
of  60  years  at  70°C  (constant)  and  2  years  at  125°C  are  expected. 
Retention  times  of  8  hours  at  a  constant  storage  temperature  in  the 
150°C  to  175°C  range  are  projected.  These  retention  times  are  adequate 
for  the  CSFDR  system  application  when  state-of-the-art  insulation  tech¬ 
niques  are  considered. 

The  read  cycle  time  of  less  than  1  microsecond  is  compatible  with 
the  CSFDR  system.  Recent  improvements  in  MNOS  technology  have  reduced 
the  erase/write  cycle  time  to  100  microseconds.  Although  this  erase/ 
write  cycle  is  slow  when  compared  to  the  read  cycle,  it  is  compatible 
with  a  CSFDR  system  memory  hierarchy  when  a  "scratchpad"  memory  is  used 
for  data  compression.  Additionally,  read/write  power  dissipations  in 
the  100  microwatt  range,  retention  in  excess  of  30  years,  and  endurance 
of  106  cycles,  make  this  technology  a  good  candidate  for  the  CSFDR 
system  crash-protected  memory  when  used  in  the  hybrid  package  config¬ 
urations  . 

b.  MNOS  BORAM  (block-oriented  random  access  memory).  Mili¬ 
tarized  MNOS  BORAM  is  available  via  two  USA  electronics  houses  and  one 
foreign  country  electronics  house.  In  all  three  cases,  the  8-kilobit 
chips  are  available.  The  US  Air  Force,  Army,  and  Navy  have  continually 
funded  MNOS  BORAM  developments  during  the  past  decade  because  of  its 
tremendous  potential  where  non-volatility  is  required19. 

A  primary  difference  between  standard  MNOS  EAROM  technology  and 
MNOS  BORAM  is  the  data  transfer  rate  achievable  via  block  operations. 

The  required  data  for  a  block  transfer  is  read  in  parallel  into  shift 
registers  and  then  multiplexed  onto  the  system  1/0  bus  as  required. 
Conventional  shift  registers  provide  the  external  storage  to  accomplish 
this  function  as  shown  in  figure  34. 

1 ‘Ibid. 

19Belt,  Ronald  A.,  "Advanced  Memories  for  Military  Systems",  NAECON 
Record,  1976. 
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Figure  34.  MNOS  Array  Block  Diagram 

In  either  a  read  or  write  mode,  the  block  address  is  applied  to  the 
block  decoder  which  accesses  the  memory  cell  matrix  column  M  bits  long. 
Data  is  then  transferred  M  bits  in  parallel,  between  the  matrix  and  the 
N-bit  shift  registers,  the  direction  of  data  flow  being  determined  by 
the  operating  mode  (read  or  write).  Data  transfer  between  the  memory 
array  shift  register  and  the  internal  BORAM  data  bus  is  accomplished 
through  the  multiplexer  buffer.  Extensive  use  of  hybrid  packaging 
techniques  would  provide  the  extremely  high  densities  required  by  the 
CSFDR  system  applications. 

The  MNOS  BORAM  is  an  excellent  candidate  for  the  CSFDR  system 
survivable  memory.  It  has  all  of  the  advantages  of  MNOS  EAROM  tech¬ 
nology.  Additionally,  it  has  an  improved  data  transfer  rate  (5/2 
improvement),  and  a  full  military  operating  temperature  range,  both  of 
which  are  improvements  over  MNOS  EAROM. 

c.  MNOS/SOS  (metal-nitride-oxide-semiconductor/silicon-on- 
sapphirt).  Silicon-on-sapphire  for  use  in  the  military/aerospace  com¬ 
munity  is  confined  to  one  manufacturer  of  integrated  circuits.  (Other 
companies  developing  SOS  technology  have  not  introduced  integrated 
circuits  to  the  general  marketplace  at  this  time.)  Although  this  tech¬ 
nology  offers  one  of  the  best  speed  power  products  of  any  technology  in 
the  semiconductor  industry,  it  is  not  recommended  for  the  CSFDR  system 
survivable  memory.  This  is  primarily  due  to  the  high  processing  costs 
and  lack  of  a  second  source. 


d.  TTL  (Transistor  Transistor  Logic).  Bipolar  TTL  integrated 
circuit  memory  is  basically  characterized  as  high  speed  devices  with  35~ 
to  100-nanosecond  access  time.  They  require  only  a  +5  volt  power  supply 
and  their  output  levels  are  compatible  with  the  industry's  most  popular 
logic  family.  However,  they  have  the  disadvantages  ot  high  power  dis¬ 
sipation,  low  bit  density,  relatively  high  cost,  volatility,  and  do  not 
provide  for  reduced  voltages  for  data  retention.  Frr  these  reasons,  TTL 
is  excluded  as  a  CSFDR  system  survivable  memory  candidate  technology. 

e.  I2L  (integrated  injection  logic).  Bipolar  I2L  memories 
have  many  excellent  features.  They  exhibit  high  bit  densities,  rela¬ 
tively  low  power  dissipation,  access  times  in  the  50-  to  100-nanosecond 
range,  and  low  data  retention  power.  In  spite  of  the  relatively  low 
power  consumption  of  these  devices,  they  can  consume  more  power  during 
operation  than  CMOS  devices  when  tiie  read/write  data  rates  become  high. 
Also,  this  is  a  volatile  memory  technology.  Therefore,  we  do  not  recom¬ 
mend  this  technology  for  the  CSFDR  system  survivable  memory. 

f.  I3L  (isoplanar  integrated  injection  logic).  The  isoplanar 
process  substitutes  thermally  grown  oxide  for  the  P-type  diffusions  that 
isolate  active  elements  of  conventional  bipolar  devices.  This  process 
permits  a  very  small  die  size  (11,716  mil2)  which  is  smaller  than  many 
competetive  devices.  Thus,  it  provides  a  higher  density,  higher  yield, 
and  lower  cost  than  competitive  MOS  devices.  Higher  speeds  are  also 
achieved  because  the  smaller  die  size  results  in  faster  parts  since 
parasitic  capacitances  are  reduced.  These  devices,  however,  are  vola¬ 
tile  and  currently  available  from  only  one  source.  Therefore,  they  are 
not  recommended  for  the  CFSDR  system. 

g.  CMOS  (complementary  metal  oxide  semiconductor).  CMOS  is  a 
mature,  proven  semiconductor  technology  and  has  been  qualified  for  use 
in  severe  military  environments.  High  reliability  has  been  established 
and  manufacturers  routinely  supply  devices  to  military  specifications 
for  operation  over  a  temperature  range  of  -55°C  to  +125°C.  Advances 
over  the  last  few  years  in  the  fabrication  processes  have  resulted  in 
improved  bit  densities.  These  same  improvements  have  also  resulted  in 
improved  operating  speed  and  reduced  power  consumption. 

It  should  be  emphasized  that  1)  the  power  dissipation  of  most 
types  of  volatile  semiconductor  memories  is  too  high  to  allow  a  reason¬ 
able  size  battery  to  retain  the  data  for  the  desired  length  of  time 
following  the  crash,  and  2)  CMOS  is  a  volatile  technology.  However,  the 
power  dissipation  of  the  new  CMOS  devices  is  so  low  that  these  devices 
are  attractive  for  the  CSFD*-  system  survivable  memory.  CMOS  memories 
with  battery  backup  are  being  used  to  provide  a  non-volatile  memory 
system  in  a  number  oi  military/aerospace  applications  and  multiple 
sourcing  is  not  a  problem.  Battery  backup  in  the  power-down  mode  must 
be  an  inherent  part  of  the  memory  system  design  if  CMOS  is  used.  More¬ 
over,  the  size,  weight,  and  cost  of  the  battery  must  be  included  in  any 
comparison  of  volatile  and  non-volatile  memory  technologies. 
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Most  available  batteries  do  not  have  the  required  operation  and 
shelf  life  qualities  for  the  temperature  ranges  to  be  encountered  in  the 
CSFDR  system  application.  One  notable  exception  is  the  lithium  solid-state 
battery.  This  battery  is  capable  of  operation  and  storage  over  the 
required  temperature  range  with  no  measurable  self-discharge.  Cells 
have  been  stored  at  temperatures  up  to  100°C  for  a  period  of  one  year 
with  no  measurable  loss  in  capacity  and  its  estimated  she!*.f  life  exceeds 
20  years.  The  only  characteristic  which  has  limited  their  use  in  more 
applications  is  the  relatively  low  current  capability  of  these  cells  at 
low  temperatures.  However,  with  CMOS  memory  this  is  not  a  valid  limitation. 

The  data  retention  current  for  CMOS  memory  devices  in  the  power-down 
mode  is  primarily  the  leakage  current  of  reverse  biased  silicon  diodes 
which  exhibits  a  positive  exponential  characteristic.  Thus,  as  the 
battery's  ability  to  supply  current  is  reduced  for  decreasing  temperatures, 
the  current  demand  by  the  memory  is  also  reduced  by  an  equal  or  greater 
amount.  The  solid-state  lithium  battery  has  an  energy  density  between  5 
and  10  whr/cubic  inches.  For  a  4Kxl6-bit  memory  system  using  CMOS,  a 
single  3.8  volt,  solid-state  battery  having  an  approximate  size  of  1.2" 
diameter  x  .25"  long  would  have  the  capacity  to  support  the  memory  in 
the  power-down  mode. 

Therefore,  based  upon  the  preceding  considerations,  we  must  regard 
CMOS  memory  technology  coupled  with  a  specialized  lithium  solid-state 
battery  design  as  a  viable  candidate  for  the  CSFDR  sysUn  survivable 
memory. 

h.  CMOS/SOS.  One  company  is  developing  CMOS/SOS  circuits 
under  contract  to  the  Office  of  Naval  Research  for  use  in  air-to-air 
missiles.  As  with  the  case  of  MN0S/S0S,  the  high  processing  costs  and 
lack  of  second  source  make  this  technology  unattractive  for  the  CSFDR 
system. 

i.  NMOS  (N-channel  metal-oxide  semiconductor).  Both  the 
static  and  dynamic  NMOS  chips  have  advantages  over  some  semiconductor 
technologies  for  this  application.  They  have  excellent  bit  densities, 
relatively  fast  write  cycle  times,  have  recently  been  tested  over  full 
military  temperature  ranges,  and  have  excellent  costs  per  bit.  However, 
because  of  their  volatility  and  relatively  high  read/write  power  (approx¬ 
imately  10/1  over  CMOS)  these  devices  would  create  severe  thermal  problems 
when  packaged  in  an  insulated  crash-survivable  memory  module.  Therefore, 
neither  the  static  nor  dynamic  NMOS  is  recommended. 

j.  MNOS  EE-PROM  (electrically  erasable  programmable  read-only 
memory).  Two  types  of  EE-PROM  devices  have  recently  been  announced.  1) 

MNOS  based20,  and  2)  NMOS  based21.  Each  device  has  excellent  qualities 
for  the  CSFDR  system  application. 

20Johnson,  W.S. ,  "16-K  EE-PROM  Relies  on  Tunneling  for  Byte-Erasable 
Program  storage",  Electronics ,  February  28,  1980. 

21Shelton,  E.K.,  "Low-Power  EE-PROM  Can  Be  Reprogrammed  Fast",  Electronics , 
July  31,  1980. 
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The  MNOS  based  EE-PROM  is  a  16,384-bit  fully  static  device  and  is 
either  byte  or  chip  erasable.  It  is  non-volatile.  The  device  meets  the 
goals  of  high  density,  long-term  retention,  high  performance,  and  endur¬ 
ance  required  by  the  CSFDR  system.  Figure  35  shows  the  MNOS  EE-PROM 
memory  cell. 
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Figure  35.  MNOS  EE-PROM  Memory  Cell 


The  heart  of  this  device  relies  upon  electron  tunneling  through 
thin  oxide  to  charge  and  discharge  a  floating  gate.  The  floating  gate 
is  capacitively  coupled  to  a  positive  potential  when  a  voltage  (V  )  is 

U 

applied  co  the  top  gate  and  when  the  drain  voltage  (V^)  is  at  0  volts. 
Electrons  are  then  attracted  through  the  tunnel  oxide  to  charge  the 
floating  gate.  Applying  a  positive  potential  to  the  drain  and  grounding 
the  gate  reverses  the  process  to  discharge  the  floating  gate.  Thus,  a 
very  simple,  reproducible  means  for  programming  and  erasing  a  memory 
cell  is  provided. 
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This  technology  is  expected  to  become  the  standard  form  of  non¬ 
volatile  storage  in  microprocessor-based  systems  of  the  future.  It  is 
considered  a  viable  candidate  for  the  survivable  memory  of  the  CSFDR 
system. 

k.  NMOS  EE-PROM.  EE-PROMs  can  also  be  built  using  NMOS 
technology21.  When  used  in  conjunction  with  CMOS  peripheral  circuitry, 
a  non-volatile  memory  system  requiring  very  little  power  results.  An 
8,192-bit  chip  has  recently  been  introduced.  This  device  requires  only 
25  milliwatts  during  programming  and  erasing,  and  10  milliwatts  during 
reading.  Only  17  volts  are  required  for  programming  this  device,  as 
opposed  to  25  volts  for  MNOS  EE-PROMs.  Memory  retention  is  estimated  at 
10  years  at  elevated  temperatures  of  125°C.  The  memory  cell  is  shown  in 
figure  36. 


POLYSILICON 


Figure  36.  NMOS  EE-PROM  Memory  Cell 

The  memory  ceil  consists  of  a  single  transistor  having  a  split-gate 
structure.  The  left  side  of  the  transistor  contains  the  dual-gate  stor¬ 
age  portion  of  the  cell,  formed  by  a  polysilicor.  floating  gate  overlaid 
by  an  aluminum  control  gate.  The  aluminum  layer  also  extends  to  the 
right,  thereby  serving  as  a  cell  selector  gate. 


2 1  Ibid. 
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The  polysilicon  floating  gate  is  isolated  from  the  MOS  channel  by 
the  tunnel  oxide  and  the  normal  gate  oxide.  It  is  isolated  from  the 
control  gate  above  it  by  a  nitride-oxide  sandwich.  This  thin  dielectric 
sandwich  is  crucial  because  it  ensures  a  strong  capacitive  coupling 
between  the  gates  permitting  17  volts  to  charge  and  discharge  the  float¬ 
ing  gate. 

The  erasing  and  storage  operations  are  initiated  by  raising  the 
supply  voltage  pin  to  the  +17-volt  programming  voltage  and  then  applying 
TTL-level  signals  to  the  chip-enable  and  output-enable  lines. 

An  internal  voltage  detector  monitors  the  power  supply  voltage 
level.  If  this  voltage  is  elevated  above  about  +8  volts,  the  detector 
automatically  throws  the  chip  into  the  erase-and-program  mode.  A  logic 
low  pulse  on  the  output-enable  lines  now  causes  bulk  erasure  of  the 
memory,  and  a  logic  low  pulse  applied  to  chip-enable  programs  the  byte 
at  the  location  selected  by  the  address  bus  with  the  information  present 
on  the  data  bus.  During  erasure  or  programming,  the  output  bus  drivers 
are  automatically  turned  off  so  that  the  raised  supply  voltage  does  not 
damage  any  devices  connected  to  the  EE-PROM. 

In  summary,  the  low  power,  good  endurance  retention  at  high  temper¬ 
atures,  good  chip  density,  non-volatility,  and  excellent  cycle  times 
make  this  technology  an  excellent  candidate  for  the  survivable  memory 
portion  of  the  CSFDR  system. 

l.  PMOS  (P-channel  MOS).  PMOS  is  the  most  mature  semi¬ 

conductor  technology  reviewed  for  this  study.  Tt  derives  its  name  from 
the  fact  that  the  conducting  channel  between  source  and  drain  of  the 

MOS  FET  is  P-type  material.  Multiple  power  supplies  are  usually  required 
because  the  threshold  level  on  PMOS  memory  cells  is  relatively  high  and 

a  negative  gate  to  source  voltage  is  necessary.  Unfortunately,  the 
read/write  power  dissipation  is  very  high  (approximately  25  to  50  times 
greater  than  CMOS).  Because  of  these  two  negative  features  (high  power 
and  volatility),  this  technology  does  not  warrant  consideration  for  the 
CSFDR  system. 

m.  VMOS  (V-groove  MOS).  VMOS  is  basically  an  N-channel  MOS 
logic  structure  integrated  on  a  three-dimensional  surface  rather  than  in 
two  dimensions.  Although  this  technology  has  some  interesting  features, 
its  high  power  dissipation  (625  microwatts)  eliminates  it  as  a  viable 
CSFDR  system  candidate. 

n.  ECL  (emitter-coupled  logic).  Bipolar  emitter-coupled 
logic  memories  operate  in  the  transistors'  linear  region.  This  allows 
extremely  high  speed  because  the  time  required  to  bring  the  transistor 
out  of  saturation  is  eliminated.  However,  these  devices,  like  the 
bipolar  TTL  devices,  have  very  high  power  dissipation,  relatively  high 
cost,  and  are  volatile.  Thus,  they  are  not  nearly  as  attractive  for  thp 
CSFDR  system  application  as  other  solid-state  technologies. 
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o.  CCD  (charge-coupled  devices).  CCD  memory  fills  a  need: 
it  fits  into  the  gap  between  other  semiconductor  and  magnetic  media. 

Chip  organization  is  important,  and  there  are  three  ways  to  organize  a 
CCD  memory  chip:  synchronous,  serial-parallel-serial,  and  line- 
addressable  RAM. 

Available  CCD  memories  are  either  serial-parallel-serial  types  or 
line-addressable  RAMs.  In  the  serial-parallel-serial  organization,  paral¬ 
lel  lines  of  data  move  simultaneously  to  a  row-end  detector,  shortening 
access  time;  but  this  is  more  complex  to  build  and  dissipates  more  power. 
Finally,  the  line-accessible  organization,  in  which  each  line  of  data  is 
accessed  at  random,  is  the  fastest  and  dissipates  relatively  low  power. 

A  basic  CCD  cell  occ  oies  60%  of  the  area  of  a  1-transistor  MOS  RAM 
cell.  In  addition,  the  (.  memory  has  less  overhead  requirements,  all 
tending  to  increase  density. 

To  store  digital  data  in  these  devices,  charge  signals  must  be 
periodically  refreshed  or  regenerated.  Overall  design  of  different  CCD 
memory  chips  reflects  the  emphasis  placed  on  one  or  more  of  the  fol¬ 
lowing:  clock  power,  access  time,  chip  overhead  for  peripheral  circuits, 
frequency  ranges,  temperature  range,  and  the  number  of  CCD  clock  phases. 

CCD  memories  are  considerably  slower  than  MOS  or  bipolar  memories 
and  have  reduced  operating  temperature  ranges.  For  these  reasons  they 
are  not  recommended  for  the  CSFDR  system. 

p.  Bubble.  Magnetic  bubbles  are  formed  in  thin  sheets  cf 
certain  magnetic  oxides  by  applying  a  biasing  magnetic  field  perpen¬ 
dicular  to  the  plane  of  the  sheet.  They  are  not  semiconductor  devices, 
but  are  an  LSI  technology  and  deserve  consideration  for  the  CFSDR  system. 

A  bubble  represents  a  "1"  and  the  absence  of  a  bubble  means  "0". 

The  tiny  bubbles,  measuring  just  5  microns  across  (a  micron  is  a  millionth 
of  a  meter),  are  actually  cylindrical  magnetic  islands  polarized  in  a 
direction  opposite  from  that  of  the  film.  The  tiny  bubbles  appear,  dis¬ 
appear,  and  move  around  on  the  surface  of  the  crystalline  chip  .nder  the 
control  of  a  magnetic  field.  See  figure  37. 

Bubbles  are  non-volatile  with  a  slow  serial  speed,  but  system 
throughput  may  approach  the  highest  speed  silicon  RAMs  where  associative 
and  parallel  processing  can  be  used. 

Magnetic-hubble  memories  unite  most  of  the  outstanding  capabilities 
of  solid-state  and  electromechanical  storage. 


248 


Figure  37.  Bubble  Memory  Device 

In  comparison  with  fixed-head  and  floppy  disks,  bubbles  have  a 
higher  reliability  and  a  lower  error  rate  since  they  employ  no  moving 
parts.  Other  assets  are  a  faster  access  time,  less  power  consumption, 
smaller  physical  size,  simple  interfacing,  and  a  lower  entry  price,  all 
resulting  from  the  elimination  of  mechanical  elements. 

One-megabit  devices  are  available  which  operate  over  the  -30°  to 
+80°C  temperature  range,  and  standby  over  the  -50°  to  100°C  temperature 
range.  Chip  densities  are  excellent  and  the  data  retention  is  unlimited 
for  all  practical  purposes.  Thus,  the  magnetic  bubble  memory  technology 
is  a  viable  candidate  for  the  CSFDR  system  survivable  memory  module. 

3.3. 1.4  Data  storage  characteristics  table  -  The  characteristics 
of  each  memory  technology  surveyed  are  shown  in  table  32.  This  table 
includes  four  electromechanical  memories,  two  nonsolid-state  electronic 
memories,  and  seventeen  solid-state  electronic  memories. 

3. 3. 1.5  Analysis  of  prime  candidates  -  A  review  of  the  rationale 
presented  in  the  previous  paragraphs  and  the  associated  table  32,  shows 
that  there  are  six  technologies  which  warrant  further  consideration  for 
the  survivable  memory  module:  1)  MNOS  EAROM,  2)  MNOS  BORAM,  3)  CMOS 
with  special  solid-state  lithium  battery,  4)  MNOS  EE-PROM,  5)  NMOS 
EE-PROM,  and  6)  bubble  memory.  A  comparison  of  the  read  and  write  power 
for  MNOS  EAROM  and  MNOS  BORAM  clearly  shows  MNOS  BORAM  as  having  a 
significant  advantage.  Power  dissipation  is  an  extremely  important 
parameter  for  the  survivable  memory.  Therefore,  MNOS  EAROM  is  elim¬ 
inated.  Similarly,  when  MNOS  EE-PROM  is  compared  with  NMOS  EE-PROM,  we 
find  that  NMOS  EE-PROM  has  a  significant  advantage  in  the  power  dis¬ 
sipation  category.  Therefore,  we  also  eliminate  MNOS  EE-PROM  from  the 
list  in  favor  of  NMOS  EE-PROM.  T> as  the  basic  list  of  four  electro¬ 
mechanical  memcries,  two  non-sol id-state  electronic  memories,  and  seven¬ 
teen  solid-state  memories  is  reduced  to  the  following  four  prime  candidates 
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In  comparison  with  fixed-head  and  floppy  disks,  bubbles  have  a 
higher  reliability  and  a  lower  error  rate  since  they  employ  no  moving 
parts.  Other  assets  are  a  faster  access  time,  less  power  consumption, 
smaller  physical  size,  simple  interfacing,  and  a  lower  entry  price,  all 
resulting  from  the  elimination  of  mechanical  elements. 

One-megabit  devices  are  available  which  operate  over  the  -30°  to 
+80°C  temperature  range,  and  standby  over  the  -50°  to  100°C  temperature 
range.  Chip  densities  are  excellent  and  the  data  retention  is  unlimited 
for  all  practical  purposes.  Thus,  the  magnetic  bubble  memory  technology 
is  a  viable  candidate  for  the  CSFDR  system  survivable  memory  module. 

3.3. 1.4  Data  storage  characteristics  table  -  The  characteristics 
of  each  memory  technology  surveyed  are  shown  in  table  32.  This  table 
includes  four  electromechanical  memories,  two  nonsolid-state  electronic 
memories,  and  seventeen  solid-state  electronic  memories. 

3.3. 1.5  Analysis  of  prime  candidates  -  A  review  of  the  rationale 
presented  in  the  previous  paragraphs  and  the  associated  table  32,  shows 
that  there  are  six  technologies  which  warrant  further  consideration  for 
the  survivable  memory  module:  1)  MNOS  EAROM,  2)  MNOS  BORAM,  3)  CMOS 
with  special  solid-state  lithium  battery,  4)  MNOS  EE-PROM,  5)  NMOS 
EE-PROM,  and  6)  bubble  memory.  A  comparison  of  the  read  and  write  power 
for  MNOS  EAROM  and  MNOS  BORAM  clearly  shows  MNOS  BORAM  as  having  a 
significant  advantage.  Power  dissipation  is  an  extremely  important 
parameter  for  the  survivable  memory.  Therefore,  MNOS  EAROM  is  elim¬ 
inated  Similarly,  when  MNOS  EE-PROM  is  compared  with  NMOS  EE-PROM,  we 
find  that  NMOS  EE-PROM  has  a  significant  advantage  in  the  power  dis¬ 
sipation  category.  Therefore,  we  also  eliminate  MNOS  EE-PROM  from  thp 
list  in  favor  of  NMOS  LE-PROM.  Thus  the  basic  list  of  four  electro¬ 
mechanical  memories,  two  non-solid-state  electronic  memories,  and  seven¬ 
teen  solid-state  memories  is  reduced  to  the  following  four  prime  candidates: 
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1 )  MNOS  BORAM 

2)  CMOS  and  special  solid-state  lithium  battery 

3)  NMOS  EE -PROM 

4)  Bubble 

These  four  leading  memory  technology  candidates  are  now  analyzed  in 
greater  detail.  Potential  crash-survivable  memory  configurations, 
utilizing  these  technologies,  are  listed  in  table  33.  These  configura¬ 
tions  cover  the  range  of  crash-protected  memory  modules  required  for 
CSFDR  system  configurations  I,  II,  and  III.  Because  of  the  numerous  and 
overwhelming  advantages  of  a  microprocessor  in  the  system,  all  memory 
configurations  are  assumed  to  operate  in  conjunction  with  a  microprocessor. 


Table  33.  Matrix  of  Prime  Memory  Technology  Candidates  For 
CSFDR  Crash-Protected  Memory  Module 


MEMORY  SIZE 

MEMORY  TECHNOLOGY 

MNOS 

BORAM 

CMOS 

& 

BATTERY 

NMOS 

EE-PROM 

BUBBLE 

65,536  bits 

A 

B 

C 

D 

131,072  bits 

E 

F 

G 

H 

262,144  bits 

1 

J 

K 

L 

It  should  be  noted  that  all  four  memory  technologies  can  be  used  in 
a  crash-survivable  system.  The  problem  is,  therefore,  reduced  to  selecting 
the  best  memory  technology  of  the  four,  keeping  in  mind  that  size, 
weight,  and  LCC  are  princ  iple  constraints  for  the  A/F/T  applications. 

Note  the  relative  ranking  of  these  four  memory  technologies  in 
table  34. 


a.  MNOS  BORAM  configuration.  Table  34  shows  this  technology 
to  be  outstanding  in  terms  of  transfer  rate,  readout,  volatility,  operating 
temperature  range,  bit-error  rate,  and  qualification.  MNOS  BORAM  chips 
are  available  from  two  national  sources  and  one  foreign  source.  Chip 
densities  of  8Kxl  bit  are  available.  Thus,  8,  16,  and  32  chips  are 
required  for  memory  configurations  A,  E,  and  I,  respectively,  and  no 
size/weight  penalty  would  result  from  the  use  of  this  technology.  The 
only  negative  characteristic  of  this  technology  is  the  slight  cost 
penalty  per  bit  when  compared  to  bubble  or  NMOS  EE-PROM. 
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Table  34.  Relative  Rank  of  Four  Prime  Memory  Candidates 
for  Each  Pertinent  Characteristic 


TECHNOLOGY 

CHARACTERISTIC 

MNOS 

BORAM 

CMOS 

& 

BATTERY 

NMOS 

EE -PROM 

BUBBLE 

Read  access  time 

3 

2 

1 

4 

Write  access  time 

2 

1 

3 

4 

Transfer  rate 

1 

3 

1 

4 

Readout 

1 

1 

1 

1 

Volatility 

1 

4 

1 

1 

Operating  temperature 
range 

1 

1 

1 

4 

System  cost/bit 

3 

4 

2 

1 

Read  power/bit 

2 

4 

1 

3 

Write  power/bit 

2 

4 

1 

3 

Retention 

2 

4 

3 

1 

Endurance 

2 

1 

2 

1 

Density  (chip) 

3 

4 

2 

1 

Second  source 
availability 

2 

1 

4* 

2 

Bit  error  rate 

1 

1 

1 

1 

Qualification 

1 

2 

3 

4 

Production  lead  time 

3 

4 

1* 

2 

^Projected  by  mid  1981  calendar  year 
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b.  CMOS  &  solid-state  lithium  battery  configurations. 

Table  34  shows  this  technology  to  be  outstanding  in  terms  of  write 
access  time,  readout,  operating  temperature  range,  endurance,  second 
source  availability,  and  bit  error  rate.  However,  this  technology  is 
volatile  and  a  special  solid-state  lithium  battery  would  have  to  be 
designed.  The  battery,  in  turn,  increases  the  technological  risk, 
reduces  the  reliability,  increases  the  volumetric  density,  and  increases 
the  production  lead  time.  (No  off-the-shelf  battery  surveyed  had  the 
reliability,  maintainability,  and  shelf-life  features  desired  for  the 
CSFDR  system  application.)  Additionally,  the  cost  per  bit  of  this 
technology  makes  configurations  B,  F,  and  J  the  highest  priced  config¬ 
urations  in  table  33.  Thus,  due  to  the  adverse  LCC  effects  of  the 
special  battery  and  relatively  high  memory  prices,  this  technology  is 
the  least  attractive  of  the  four  prime  candidates. 

c.  NMOS  EE-PROM  configurations.  Although  this  technology  is 
called  "NMOS",  a  nitride  layer  is  used  to  achieve  non-volatility  in  a 
fashion  very  similar  to  "MNOS" .  The  resulting  technology  is  outstanding 

in  terms  of  read  access  time,  transfer  rate,  readout,  volatility,  operating 
temperature  range,  read/write  power,  bit  error  rate,  and  projected 
production  lead  times.  Additional  features  whio*i  make  it  attractive  for 
the  CSFDR  system  application  are  its  good  price  per  bit,  good  endurance, 
and  good  density.  One  of  its  primary  advantages  over  the  competing 
technologies  is  its  unusually  low  power  dissipation  of  .2  to  .5  microwatts 
per  bit.  Because  of  the  two-way  insulation  problems  inherent  in  the 
crash-protected  memory  module  design,  low  power  devices  are  essential. 
Additionally,  these  devices  cost  only  about  one-half  as  much  as  MNOS 
BORAM  devices  and  a  mere  one  fiftieth  of  CMOS/battery  devices.  There¬ 
fore,  configurations  C,  G,  and  K  are  expected  to  have  the  highest  reli¬ 
ability,  lowest  total  weight,  and  lowest  total  volume  of  any  corresponding 
configuration  in  'able  33.  Moreover,  the  electronics  industry  is  projecting 
this  technology  as  the  standard  form  of  storage  for  microprocessor-based 
systems  of  the  future.  Therefore,  second  source  availability  and  production 
lead  times  are  anticipated  as  being  very  good  in  the  time  frame  envisioned 
for  the  CSFDR  system.  Both  8X  and  16K  chips  are  available  now.  There¬ 
fore,  8,  16,  and  32  chips  would  be  required  for  :onf igurat ions  C,  G,  and 
K,  respectively.  In  summary  then,  we  rank  this  technology  as  the  best 
technology  available  for  the  crash-protected  memory  of  the  CSFDR  system. 

d.  Bubble  memory  configurations.  Excellent  qualities  of  the 
bubble  memory  configurations  are  its  readout,  volatility,  system  cost 
per  bit,  retention,  endurance,  chip  density,  and  bit  error  rate.  How¬ 
ever,  the  low  chip  density  does  not  result  in  the  lowest  overall  crash- 
protected  memory  volumetric  density.  We  caution  those  who  would  use 
this  technology  in  a  crash-protected  memory  that  a  host  of  support  cir¬ 
cuitry  is  required  in  addition  to  the  bubble  module  itself.  Tnis  support 
ciriuitry  includes  coil  drivers,  function  drivers,  sense  amplitiers, 
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and  timing/control  circuitry.  Therefore,  in  spite  of  the  excellent  chip 
density  of  bubble  memories,  configurations  D,  H,  and  L  would  be  larger 
and  heavier  than  any  of  the  corresponding  technologies  in  table  33. 
Additionally,  the  bubble  devices  have  reduced  operating  temperature 
ranges.  Therefore,  we  do  not  consider  this  technology  as  good  as  NMOS 
EE-PROM  or  MNOS  BORAM  for  the  CSFDR  system  application. 

e.  Final  rank  of  memory  technologies.  It  is  technically 
feasible  to  use  any  of  the  four  prime  candidate  memory  technologies  in 
the  crash-survivable  module.  However,  we  feel  that  the  numerous  advan¬ 
tages  of  NMOS  EE-PROM  make  it  the  leading  candidate  for  the  crash-survi¬ 
vable  module  of  the  CSFDR  system.  The  four  candidates  are  ranked  as 
follows : 


Table  35.  Final  Rank  of  Prime  Memory  Candidates  For  The 
Crash-Survivable  Memory 

I.  NMOS  EE-PROM 

II.  MNOS  BORAM 

III.  Bubble  Memory 

IV.  CMOS  &  special  solid-state  lithium 

battery 
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3.3.2 


Data  processing/data  compression. 


3 . 3 . 2 . 1  Analysis  of  available  techniques  to  process  data  and 
reduce  memory  requirements  -  This  is  an  extremely  important  aspect  of 
the  CSFDR  system  study.  Since  memory  is  a  primary  cost  driver  of  the 
recording  system,  the  most  effective  method  of  converting,  formatting, 
and  compressing  the  data  must  be  determined  in  order  to  minimize  the 
amount  of  solid-state  memory  required.  However,  the  data  processing/data 
compression  effort  must  not  lose  sight  of  the  the  fact  that  an  acceptable 
level  of  data  fidelity  must  be  retained  after  compression  and  ground 
read-out  in  order  to  be  beneficial  in  an  accident/mishap  investigation. 

The  options  are: 

(1)  Reduce  the  number  of  recorded  parameters  (eliminate 
dependent  parameters  without  losing  information). 

(2)  Open  up  the  tolerances  for  the  reconstructed  parameter 
profiles,  thereby  reducing  the  number  of  bits  per  word  required. 

(3)  Retain  less  flight  time  prior  to  the  incident. 

(4)  Sample  all  parameters,  but  record  only  if  outside 
established  boundaries. 


In  any  case,  the  delicate  balance  between  the  number  of  parameters 
recorded  and  the  size  of  the  solid-state  crash-protected  memory  must  be 
established.  This  is  especially  true  for  Configuration  II. 

a.  Data  word  organization.  The  data  word  organization  within 
the  data  processor/data  converter  unit  and  crash-protected  memory  unit 
must  be  sufficient  to  allow  their  use  in  an  accident/mishap  investiga¬ 
tion.  Thus,  after  ground  readout,  the  capability  of  accurately  recon¬ 
structing  or  reducing  the  following  is  required: 


aircraft  grouad  track  and  altitude  vs.  time 

aircraft  attitude/attitude  rates  vs.  time 

aircraft  velocities/accelerations  vs.  time 

aircraft  control  system  and  surfaces  vs.  time 

aircraft  engine  parameters  vs.  time 

pilot  inputs  vs.  time  (primarily  rudder  pedal, 
throttle,  and  stick) 


255 


•  status  of  various  aircraft  systems  vs.  time  including 
aircraft  peculiar  systems 

Thus,  the  required  word  lengths  and  sample  rates  must  be  established 
first. 


b.  Required  data  word  lengths.  The  CSFDR  system  input  parameters 
are  converted  at  the  required  sampling  rate  to  digital  form  via  the  data 
conversion  electronics  cards  and  associated  data  conversion  subroutines. 

The  conversion  electronics  cards  and  conversion  subroutines  are  functionally 
modular  in  order  to  permit  maximum  standardization  of  these  items  The 
optimum  data  word  lengths  for  conversion  and  processing  are  determined 
ns  follows: 


•  Compute  number  of  bits  needed  to  give  required 
accuracy  for  each  parameter 

•  Compote  the  total  number  of  bits  required  to  cover 
the  dynamic  range  of  each  parameter 

The  data  word  lengths  for  typical  parameters  or  parameter  groups 
are  determined  in  the  following  paragraphs: 

(1)  Relative  time.  Although  relative  time  is  not  strictly 
classified  as  a  flight  parameter,  it  is  an  extremely  important  parameter 
because  the  recorded  data  are  required  as  a  function  of  time  for  the 
accident/  mishap  investigation.  Absolute  time  (GMT),  if  available, 
could  be  used  to  compute  elapsed  oi  relative  time.  However,  this  is 
unnecessary  because,  if  elapsed  time  is  recorded,  the  absolute  time  can 
be  determined  from  flight  records,  or  by  extrapolating  forwards  or 
backwards  in  time  from  the  known  absolute  time  of  well-defined  events. 
Moreover,  absolute  time  is  not  always  necessary  to  establish  the  cause 
of  an  accident/mishap.  Thus,  it  is  sufficient  to  record  relative  time 
via  the  infernal  clock  of  the  CSFDR  system.  Additionally,  it  is  net 
necessary  to  record  time  continuously,  but  simply  to  time  tag,  in  an 
optimum  way,  the  recorded  data.  The  resolution  required  is  0.25  seconds 
for  the  data  sampled  at  the  higher  rates.  The  maximum  range  for  elapsed 
time  is  a  function  of  the  flight  profile.  Although,  on  the  average, 
Configuration  II  will  store  the  last  nineteen  minutes  of  data,  in  highly 
turbulent  flight  profiles,  the  CPM  will  be  filled  in  less  than  nineteen 
minutes  of  flight  and  data  wraparound  will  occur.  Moreover,  if  the 
fligh.  is  lengthy,  as  is  the  case  where  air-to-air  refu'  iing  c  curs,  it 
will  be  necessary  to  know  which  cycle  the  CPM  is  operating  in.  Thus,  a 
total  of  16-bits  are  required  for  relative  time.  This  will  give  a 
resolution  of  0.25  seconds  and  total  elapsed  time  in  excess  of  4.55 
hours . 
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The  required  16  bits  may  also  be  divided  into  8  bits  for  a  synchro¬ 
nization  frame  (at  the  rate  of  one  frame  per  minute)  and  8  bits  for  the 
relative  time  tag  between  synchronization  frames.  In  this  case,  a  total 
of  16  bits  will  provide  4.28  hours  of  time,  with  a  resolution  of  0.25 
seconds . 

(2)  Calibrated  airspeed  (CAS).  The  accuracy  required 
for  CAS  is  five  knots.  The  required  range  is  1 ,000  knots.  With  eight 
bits,  a  range  of  1,000  knots  with  a  resolution  of  3.9  knots  is  achieved. 

(3)  Fuel  flow.  Military  aircraft  achieve  very  high 
rates  of  engine  fuel  flow  for  relatively  short  periods  of  time.  A  good 
generalized  range  for  this  parameter  is  110,000  PPH.  With  eight  bits  a 
range  of  110,000  PPH  with  a  resolution  of  430  PPH  (0.119  PPS)  is  achieved 
for  each  engine. 

(4)  Altitude.  The  required  range  for  altitude  is  -1,000 
to  80,000  feet.  The  organization  of  this  parameter  is  a  function  of  the 
type  of  sensor  used.  For  the  majority  of  cases  the  air  data  computer  is 
the  assumed  altitude  source.  Although  modern  aircraft  have  several 
sources,  these  other  sources  of  altitude  arc-  not  required  to  be  opera¬ 
tional  for  flight.  When  available,  however,  these  alternate  sources 
provide  excellent  accuracies  and  could  be  used.  Therefore,  two  altitude 
formats  are  recommended. 

•  Coarse  altitude  -  11  bits  provides  a  range  of  -1,000 
to  80,000  feet  with  a  resolution  of  78.1  feet  (one 
bit  reserved  for  sign). 

•  Fine  altitude  -  16  bits  provides  a  range  of  -1,000 
to  80,000  feet  with  a  resolution  of  2.44  feet  (one 
bit  reserved  for  sign). 

(5)  Engine  RPMS .  Core  and  fan  RPMS  require  a  generalized 
range  of  120%.  Seven  bits  gives  the  complete  desired  range  with  a 
resolution  of  0.93%. 

(6)  Aircraft  attitude  parameters.  High  performance 
military  aircraft  are  capable  of  achieving  the  full  range  (360°)  of 
aircraft  attitudes  in  normal  flight  operations.  The  general  desired 
range  for  these  parameters  is,  therefore,  ±180°.  Thus,  nine  bits  are 
required  for  a  range  of  ±180°  with  a  resolution  of  0.7°. 

(7)  Aircraft  attitude  rates.  A/F/T  aircraft  are  capable 
of  achieving  relatively  high  attitude  rates,  especially  roll  rate.  For 
roll,  a  rate  of  ±360°/second ,  with  a  resolution  of  2.81°/second  can  be 
recorded  with  an  eight-bit  word. 
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For  pitch  and  yaw,  rates  of  ±l80°/second ,  with  resolutions  of  2.81°/second 
can  be  recorded  with  seven-bit  words. 

(8)  Throttle  position  (power  lever  angle).  This  parameter 
can  be  recorded  in  terms  of  percentage  for  each  engine.  A  maximum  range 
of  150%  is  recommended.  With  seven  bits,  the  full  range  of  150%  can  be 
recorded  with  a  resolution  of  1.2%. 

(9)  Exhaust  gas  temperature.  A  range  of  up  to  1055°C  is 
adequate  for  this  parameter.  An  eight-bit  word  will  give  a  4.12°  resolution 
which  is  adequate  for  mishap  investigation  purposes. 

(10)  Aircraft  accelerations.  Vertical,  lateral,  and 
longitudinal  accelerations  have  a  wider  range  for  high  performance 
military  aircraft  than  for  commercial  aircraft.  The  recommended  range 
for  vertical  acceleration  is  -5g  to  +  10g.  This  range  can  be  achieved 
with  an  eight-bit  word  having  a  resolution  of  0.08g.  For  both  lateral 
and  longitudinal  accelerations  a  range  of  ±5g  is  recommended.  A  seven-bit 
word  having  a  resolution  of  0.08g  can  be  used  for  lateral  and  longitudinal 
accelerations . 

(11)  Control  surface  positions.  Primary  control  surfaces 
and  secondary  trim  surfaces  can  be  represented  within  a  full  scale  range 

of  ±70°.  An  eight-bit  word  will  provide  this  range  with  a  0.55°  resolution. 

(12)  Fuel  quantity  and  individual  tank  quantity.  For 
the  A/F/T  aircraft  surveyed,  a  maximum  range  for  fuel  load  of  30,000 
lbs.  is  adequate.  This  load  is  calculated  assuming  JP-4  at  6.5  lb. /gal. 
and  JP-8  at  6.7  lb. /gal.  An  eight-bit  word  gives  the  30,000  lb.  range 
with  a  resolution  of  117  lbs,  which  is  adequate  for  this  parameter. 

(13)  Stick  position  or  force.  Units  for  stick  position/ 
force  can  be  expressed  in  1)  inches  of  travel ,  2)  degrees  of  movement, 
or  3)  pounds  of  force.  Thus,  it  is  recommended  that  this  parameter  be 
recorded  as  a  percentage  of  full  scale.  An  eight-bit  word  for  both 
lateral  and  longitudinal  stick  position,  will  yield  the  desired  range  of 
travel  with  a  resolution  of  0.8%. 

(14)  Angle  of  attack.  A  range  of  ±40°  is  adequate  for 
this  parameter.  An  eight-bit  word  gives  the  desired  range  with  a  resolu¬ 
tion  of  0.3°. 

(15)  Heading  (true  or  mag).  Full  heading  range  is  360°. 

A  single  eight-bit  word  will  provide  a  1.4°  resolution  which  is  sufficient 
when  an  analog  air  data  computer  is  used.  If  more  accurate  heading 
sources  are  available,  a  ten-bit  word  can  be  used  to  provide  a  resolut 
of  0.35°. 


258 


(16)  Hydraulic  pressure  (main  and  utility).  The  aircraft 
surveyed  in  this  study  have  hydraulic  pressure  systems  in  the  0  to  5000 
PSIG  range.  An  eight-bit  word  allows  a  resolution  of  19.5  PSIG. 

(17)  Oil  pressure.  The  recommended  range  for  oil  pressure 
is  0  to  100  PSJG.  A  six-bit  word  permits  a  resolution  of  1.5  PSIG. 

(18)  Rudder  pedal  (position  or  force).  This  parameter 
can  be  expressed  as  1)  inches  of  travel,  2)  degrees  of  movement,  or  3) 
lbs.  of  force.  For  this  reason,  we  recommend  recording  it  as  a  percentage 
of  full  scale.  With  one  bit  reserved  tor  the  sign,  an  eight-bit  word 
will  provide  a  resolution  of  0.8%.  Thus,  if  full  scale  corresponds  to 
+3.5  inches  of  travel,  as  is  the  case  with  the  A-10  aircraft,  a  resolution 
of  0.02. ’3  inches  is  achieved. 

(19)  Mach  number.  Resolutions  for  Mach  number  should  be 
at  least  0.1.  With  five  bits  a  Mach  number  of  3.2  can  be  recorded  with 
a  resolution  of  0.1. 

(20)  Afterburner  positions.  The  desired  range  is  0 
to  100%.  Resolution  does  not  have  to  be  high  in  order  to  use  this 
parameter  in  an  accident  investigation.  A  resolution  of  12.5%  can  be 
achieved  with  a  four-bit  word.  Typical  ranges  are  from  -10°  to  +100°. 

(21)  Sideslip  angle.  Emphasis  within  DOD  on  control 
configured  vehicles  (CCV)  broadens  the  requirement  for  recording  sideslip 
angle.  For  yaw  pointing,  or  cockpit  pointing,  a  range  of  +30°  is  required 
for  sideslip  angle.  Ail  eight-bit  word  gives  the  desired  range  with  a 
resolution  of  0.23°. 

(22)  Generator/inverter/alternator  output.  For  accident 
investigation  purposes  these  parameters  can  be  treated  as  discretes 
which  are  valid  when  within  specified  limits  and  invalid  when  outside 
these  limits.  Typical  ranges  are  as  follows: 


Signal 
AC  primary 
AC  em?rgency 
DC  primary 


Valid  Range 
112  -  118  V 
108  -  122  V 
22.0  -  30.0  V 


DC  emergency  (battery)  18.0  -  25.0  V 


Generator  fai lure/Lrip/warning,  transformer  rectifier  warning,  and 
emergency  generator  signals  are  available  as  discretes  on  many  aircraft 
These  discretes  are  useful  for  accident  investigation  purposes.  However, 
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for  expanded  recording  purposes  it  is  recommended  that  actual  AC  and  DC 
voltage  levels  be  recorded.  For  AC  voltages,  a  range  of  0  to  230  volts 
and  a  resolution  of  0.9  volts  can  be  achieved  with  an  eight-bit  word. 

For  DC  voltages,  a  range  of  0  to  30  volts  and  a  resolution  of  0.94  volts 
can  be  achieved  with  a  five-bit  word. 

(23)  Fan  turbine  inlet  temperature  (FTIT).  FTIT  can  be 
recorded  via  an  eight-bit  word.  For  a  range  of  0-1200°C  a  resolution  of 
4.68°C  results. 


(24)  Velocities.  Vertical,  lateral,  and  longitudinal 
velocities  can  be  represented  with  a  nine-bit  word.  This  would  provide 
a  range  of  +2500  fps  with  a  resolution  of  9.7  fps. 

(25)  Outside  air  temperature/indicated  air  temperature. 
The  desired  temperature  range  is  ±100°C.  An  eight-bit  word  will  permit 
full  range  recording  of  this  parameter  with  a  resolution  of  0.78°C. 

(26)  Cabin  pressure.  For  accident  investigation  purposes 
the  cabin  pressure  warning  discrete  is  adequate.  However,  for  expanded 
recording  and  trend  analysis  the  pressure  range  should  be  recorded.  A 
range  of  0  to  50,000  feet  equivalent  pressure  altitude  can  be  recorded 
via  an  eight-bit  word  having  a  resolution  of  1Q5  feet  equivalent  pressure 
altitude . 


(27)  Wing  sweep  angle.  USAF  aircraft  such  as  the  F- 111 
and  B-l  require  recording  of  the  wing  sweep  angle.  Since  this  parameter 
does  not  change  frequently  it  does  not  have  a  large  effect  on  memory 
size.  A  range  of  wing  sweep  angles  from  10°  to  75°  can  be  recorded  with 
a  six-bit  word.  This  provides  a  resolution  of  1.01°  which  is  more  than 
adequate  for  accident  investigation  purposes. 

(28)  Cabin  temperature.  A  cabin  temperature  discrete  is 
adequate  for  accident  investigation  purposes.  For  expanded  recording, 
the  temperature  range  should  be  recorded.  A  range  of  -35°C  to  +55°C  can 
be  recorded  via  a  seven-bit  word  providing  a  resolution  of  0.85°C. 

(29)  Discretes.  The  following  parameters  are  typical  of 
those  paiameters  which  can  be  recorded  as  discrete  signals  (on/off, 
go/no-go,  v.i  i  id/ inva  1  id ,  etc.): 

■  Master  caution  light 

•  Augmentation  system  status  signals 

•  Fire  warning 
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APU/EPU/EEC/JFS  status 


•  Transmitter  keyed 

•  Paddle  switch 

•  Autopilot  on/off 

•  Altitude/attitude  hold,  turn  rate  or  heading  hold 

•  Gear  position 

•  Squat  switch 

•  Cabin  temperature  low/high 

•  Cabin  pressure  low 
Marker  beacon  passage 

•  FCC  status 

These  discretes  can  be  packed  into  a  single  sixteen-bit  word. 

c.  Required  sample  rates.  The  maximum  allowable  sampling 
rate  must  be  established  for  each  parrmeter.  Even  though  a  particular 
parameter  may  not  actually  be  recorded  for  a  relatively  long  period  of 
time,  it  must  be  sampled  at  predetermined  rates  or  it  will  not  be  possible 
to  reconstruct  the  parameter  waveform  to  the  desired  degree  of  accuracy. 

Many  flight  parameter  lists  were  reviewed  during  this  study.  These 
lists  include  both  commercial  and  military  flight  data  recorders.  Five 
of  these  lists  have  been  selected  to  demonstrate  typical  sample  rates 
required  by  crash-protected  flight  data  recorders.  The  selected  lists 
are  1)  B-l  Bomber,  21  ULAIDS  FIR,  3)  AIRS,  4)  Commercial  MINI  FDR  program, 
and  5)  commercial  DFDR  list  for  wide  body  aircraft.  The  sample  rates 
are  shown  in  table  36. 

A  review  of  table  36  shows  the  following  with  regard  to  sample 
rates : 

(1)  Aircraft  attitude  ai,d  attitude  rates  are  sampled  at 
higher  rates  for  high  performance  military  aircraft  as  expected. 

(2)  Aircraft  accelerations  must  be  sampled  at  rates  greater 
than  1/second  in  order  to  reconstruct  the  waveform  without  missing  peaks 
and  troughs.  A  rate  of  four  samples/second  is  common  for  aircraft 
accelerations . 
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(3)  Control  surfaces  are  sampled  at  higher  rates  for  high 
performance  military  aircraft.  This  is  required  because  many  control 
surfaces  can  be  changed  100%  within  a  single  second. 

When  variable  apertures  are  used  for  compressing  data  (as  will  be 
recommended  in  a  later  section),  an  additional  measure  of  the  sample 
rate  is  the  maximum  rate  of  the  parameter  in  terms  of  limit  increments 
per  sample.  For  example,  if  airspeed  has  e  10-knot  aperture  a  16.8 
ft/sec2  longitudinal  acceleration  will  have  one  limit  increment  per 
sample  rate  at  one  sample  per  second.  If  the  longitudinal  acceleration 
is  greater  than  16.88  ft/sec2,  the  uncertainty  of  the  airspeed  between 
samples  will  increase. 

If  it  is  determined  that  higher  sample  rates  are  necessary,  this 
can  be  accomplished  with  little  impact  on  the  system  cost. 

It  must  be  remembered  that  the  sample  rates  required  are  determined 
by  the  waveform  accuracy  needed  to  analyze  the  accident/mishap.  As  with 
word  size,  range,  and  resolution,  the  optimum  cost  profile  will  be 
obtained  by  meeting  the  needs  of  accident  investigations  without  adding 
unnecessary  complexity  to  the  system.  The  word  size,  parameter  range, 
tolerance,  resolution,  and  sample  rates  recommended  for  the  CSFDR  system 
are  shown  in  table  37. 

d.  Memory  reduction  techniques.  The  memory  reduction  techni¬ 
que  to  be  selected  for  the  CSFDR  system  is  extremely  critical  in  that  it 
affects  the  required  memory  size  and  input  power.  The  required  memory 
size  is  directly  proportional  to  initial  system  cost.  The  power  dissipa¬ 
tion  of  the  survivable  memory  affects  package  size,  insulation  technique, 
and  reliablity.  Thus,  the  power  dissipation  of  the  survivable  memory  is 
proportional  to  the  CSFDR  LCC.  Therefore,  the  memory  reduction  technique 
has  two  primary  purposes: 

•  Optimize  the  amount  of  information  contained  in  a 
specified  memory  size. 

•  Optimize  the  information  transfer  rate  from  the 
"scratchpad"  memory  (buffer  memory)  to  the  surviv¬ 
able  memory. 

The  microprocessor  will  be  used  to  reject  redundant  and  unneeded 
data.  The  advantage  of  using  the  microprocessor  to  perform  this  func¬ 
tion,  is  that  the  users  (accident  investigators)  can  set  the  criteria 
for  data  rejection  and  therefore  aid  in  the  memory  reduction  effort. 

Thus  the  CPM  will  receive  only  those  data  samples  conveying  the  most 
information  about  the  behavior  of  the  parameter  to  be  recorded.  Since 
all  samples  will  not  be  bused  to  the  CPM.  some  error  in  the  compressed 
signal  is  to  be  expected.  Moreover,  any  two  consecutive  samples  which 
are  received  need  not  be  consecutive  in  real-time.  Therefore,  it  is 
necessary  to  include  some  sort  of  timing  information  so  that  the  rela¬ 
tive  positions  of  bused  data  may  be  established. 
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Table  37.  Recommended  Word  Sizes  and  Sample  Rates 
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Additionally,  an  important  aspect  is  the  manner  in  which  the  sam¬ 
pled  data  is  bused  to  the  CPM.  Because  the  selected  non-redundant  data 
samples  arrive  at  non-periodic  intervals,  a  "scratchpad"  or  storage 
buffer  is  required  so  that  the  data  samples  can  be  transferred  at  a  rate 
which  will  allow  for  adequate  power  dissipation.  This  aspect  is  extremely 
imp  /rtant  in  that  it  affects  the  reliability  of  the  CPM.  This  additional 
buffering  requirement  must  be  weighed  against  the  savings  in  power  and 
MTBF  of  the  overall  CSFDR  system. 

The  following  paragraphs  describe  the  data  compression  techniques 
surveyed  for  this  study.  The  general  field  of  data  compression  normally 
divides  the  compression  methods  into  "telemetry"  techniques  and  "video" 
techniques.  The  "video"  techniques  arc  interesting;  however,  they  do 
not  lend  themselves  to  application  in  the  CSFDR  system.  Therefore,  only 
the  "telemetry"  techniques  are  discussed  in  the  following  paragraphs. 

Using  telemetry  techniques,  the  CSFDR  system  samples  parameters, 
converts  these  parameters  to  digital  form,  performs  logical  operations 
on  the  parameters,  and  buses  the  parameter  values  to  the  CPM  when  required. 
The  performing  of  logical  operations  and  the  busing  of  information  from 
the  "scratchpad"  memory  to  the  CPM  can  be  viewed  as  a  telemetry  technique. 
If  the  data  compression  method  selected  is  classified  according  to  the 
effect  it  has  on  the  data  packed  into  the  CPM,  then  the  relevant  com¬ 
pression  methods  fall  into  one  of  three  basic  categories: 

•  Direct  data  compressors 

•  Transformation  compressors 

•  Parameter  extraction  compressors 

In  the  Direct  Data  Compressors  (DDC)  the  actual  value  of  the  sam¬ 
pled  parameter  or  the  sampled  value  within  a  tolerance  window  is  recorded 
when  the  required  logical  conditions  are  met.  Predictors  and  interpola¬ 
tors  are  the  most  common  methods  used  for  DDC's.  In  each  method,  poly¬ 
nomial  curve  fitting  has  been  used  to  approximate  the  parameter  at  all 
sample  points  over  a  finite  interval.  It  is  represented  over  this  in¬ 
terval  by  its  sample  points  as  f(i),  where  i  =  0,  1,....  n.  An  n  order 
polynomial  is  then  used  to  approximate  the  parameter  to  any  accuracy 
desired.  The  accuracy  criterion  may  be  stated  as 
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(i) |  <  Kail  i,  0  ^  i  ^  n 


(1) 


n  k 

|f(i)  -  I  ak  tK 

k=0 

where  K  is  the  tolerance  and  the  a^  are  determined  by  solving  n  +  1 
equations  in  n  +  1  unknowns  which  result  by  inserting  all  values  of  i  in 
(1).  If  the  tolerance  is  zero,  the  compressor  introduces  no  additional 
error  to  the  quantized  parameter.  The  order  of  the  compressor  is  simply 
the  order  of  the  approximating  polynomial. 


The  interpolator  achieves  compression  by  transmitting  values  at 
each  end  of  a  finite  time  interval  such  that  the  polynomial  which  results 
by  connecting  these  transmitted  points  will  pass  within  the  required 
tolerance  of  all  intervening  sample  values.  The  predictor  uses  the 
polynomial  obtained  from  the  n  +  1  sample  values  as  an  estimate  for 
future  sample  values  in  the  hope  that  these  values  will  not  deviate  from 
the  polynomial  by  more  than  the  tolerance.  Compression  is  achieved  if 
the  polynomial  is  valid  for  more  than  the  n  +  1  sample  values  used.  In 
either  case,  a  time  word  is  needed  in  addition  to  the  data  word  in  order 
to  indicate  the  length  of  time  over  which  the  approximation  is  valid. 


In  the  case  of  the  predi^  or,  the  polynomial  is  extrapolated  one 
unit  at  a  time  by  means  of  i  xinite  difference  technique.  A  prediction 
equation  results  as 


where 


t-1 


Yt-i  *  4V,  *  4!Vi + 


+  AnY 


predicted  value  at  time  t 

value  of  data  one  sample  period  prior  to  t 


An+V 


AnYt  -  AnYt_1 


AY. 


Yt  ■  Yt-1 


(1)  Direct  data  compressor  using  zero-order  polynomial 
predictor.  For  the  zero-order  predictor,  equation  2  becomes 


(2) 
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The  simplest  type  of  data  compressor  using  this  technique  is  called  the 
fixed-aperture  predictor.  A  set  of  fixed  tolerance  windows  called 
apertures  is  used  to  divide  the  range  of  the  parameter  into  equal  parts. 
The  aperture  width  is  2K,  from  equation  (1),  and  is  typically  three  or 
four  times  greater  than  the  binary  resolution  of  the  digitized  signal. 

The  tolerance  can  be  established  by  the  user  by  merely  truncating  the 
last  few  bits  from  the  binary  data  word.  The  first  sampled  parameter 
will  fall  into  one  of  the  apertures,  and,  if  subsequent  values  for  this 
parameter  fall  into  the  same  aperture,  they  are  considered  redundant  and 
will  not  be  recorded  in  the  CPM.  If  subsequent  samples  fall  into  an 
aperture,  other  than  the  preceding  one,  they  are  considered  non-redundant 
and  are  recorded  in  the  CPM.  Reconstruction  of  the  recorded  values  in 
the  ground  computer  takes  place  by  assuming  the  value  of  the  parameter 
to  be  valid  over  the  sample  period.  This  gives  the  plotted  parameter 
waveform  a  step  appearance.  Figure  38  shows  the  operation  of  a  direct 
data  compressor  using  the  fixed  aperture  zero-order  polynomial  predictor, 
lr.  addition  to  demonstrating  the  technique,  this  figure  shows  the  need 
to  select  the  proper  sample  rate  for  each  CSFDR  system  parameter.  Note, 
the  error  in  predicted  sample  number  13,  due  to  the  relatively  long  sample 
time . 

A  more  complex  version  of  the  direct  data  compressor,  using  the 
zero-order  polynomial  predictor,  is  that  of  the  floating  aperture  tech¬ 
nique.  In  this  technique  the  first  sample  value  is  recorded  in  the  CPM 
and  an  aperture  of  fixed  width  is  placed  around  it.  II  subsequent 
samples  fall  within  this  aperture  they  are  not  recorded.  If  a  subse¬ 
quent  sample  falls  outside  the  aperture,  then  this  sample  is  recorded 
and  an  aperture  is  placed  around  it.  Thus  the  aperture  "floats"  with 
the  last  recorded  value  for  the  parameter.  Figure  39  illustrates  this 
method . 

A  zero-order  offset  predictor  is  also  possible.  The  floating 
aperture  technique  may  be  modified  by  combining  a  zero-order  and  first- 
order  polynomial  method.  The  zero-order  predictor  takes  advantage  of 
trends  in  the  data  by  offsetting  the  predicted  sample  by  a  specified 
amount.  The  sign  of  the  offset  is  in  the  direction  of  the  last  offset 
sample.  Therefore,  the  predicted  parameter  value  is  equal  to  the  last 
recorded  sample,  plus  or  minus  the  offset  value.  This  predicted  value 
becomes  the  center  for  a  new  aperture  ar.d  the  process  continues  as  in 
the  basic  floating  aperture  technique. 


PREDICTED  SAMPLES 
RECORDED  SAMPLES 
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38.  Direct  Data  Compressor  Using  Fixed  Aperture  Zero-Order  Polynomial  Predictor 


All  of  the  zero-order  predictors  are  easily  incorporated  into 
microprocessor-based  recording  systems.  They  require  storage  only  of 
the  present  sample,  a  future  predicted  sample,  and  the  size  of  the 
aperture.  If  the  zero-order  offset  is  used,  the  value  of  the  offset 
must  also  be  stored  in  the  program  memory. 

(2)  Direct  data  compressor  using  zero-order  polynomial 
interpolator.  Interpolators  differ  from  predictors  in  that  the  sample 
values  between  the  last  recorded  sample  value  and  the  present  sample 
value  affect  the  interpolation.  Interpolators  are  very  useful  when  the 
data  changes  rapidly  and  a  predictor  may  not  be  sufficient.  If  future 
and  past  samples  are  used  in  the  redundancy  elimination  technique,  then 
it  is  possible  to  eliminate  a  larger  percentage  of  samples.  This  so-called 
after-the-fact  polynomial  approximation  is  termed  interpolation. 


The  zero-order  interpolator  also  approximates  the  data  in  a  step-like 
reconstruction,  but  differs  in  that  tile  sample  actually  selected  for 
recording  is  determined  at  the  end  of  a  redundant  set.  With  a  predetermined 
aperture  width,  the  first  sample  outside  the  aperture  causes  a  value  to 
be  recorded  which  is  the  average  of  the  highest  and  lowest  sample  values 
between  the  current  and  last  recorded  sample.  Thus,  it  is  possible  to 
record  a  value  which  did  not  really  occur  since  the  last  recorded  sample. 

If  the  aperture  is  chosen  to  be  zero,  then  the  zero-order  predictor  and 
interpolator  are  equivalent.  Figure  40  shows  the  zero-order  interpolator 
for  the  same  source  parameter  as  was  used  for  the  zero-order  predictor. 

As  the  comparison  of  the  two  figures  (figures  39  and  40)  shows  it  is 
apparent  that  the  interpolator  is  valid  over  a  longer  period  of  time, 
but  requires  a  more  complex  airborne  computer  program  than  the  predictor. 

(3)  Direct  data  compressor  using  first-order  polynomial 
predictor.  First  order  data  compressors  approximate  parameter  values  by 
a  series  of  straight  lines.  These  data  compressors  are  best  suited  for 
parameters  which  have  long  monotonic  increasing  or  decreasing  sample 
sequences.  Zero-order  compressors  would  not  be  effective  for  sum 
parameters  because  consecutive  samples  would  be  continuously  exceeding 
the  aperture  width. 


Letting  n  =  1  in  equation  (2)  gives  us  the  first-order  predictor 
equat i on : 


Yt 


Yt-1  +AYt-i  =  2Yt-i 


t-2 


(4) 


Thus,  the  predicted  sample  value  is  the  last  value  plus  the  same 
change  as  the  last  value  changed  from  the  one  before  it.  This  technique 
is  similar  to  the  .'.ero-order  offset  technique  except  the  offset  is 
variable  rather  than  fixed. 


271 


PREDICTED  SAMPLES 


igure  39.  Direct  Data  Compressor  Using  Floating  Aperture  Zero-Order  Polynomial  Predictor 


RECORDED 
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Figure  40.  Direct  Data  Compressor  Using  Fixed  Aperture  and  Zero-Order 


The  compressor  records  the  first  two  sample  values  thereby  defining 
a  straight  line  and  the  third  sample  is  predicted  to  lie  on  this  line. 

An  aperture  of  fixed  width  is  then  positioned  around  the  predicted 
sample.  If  the  third  sample  value  is  in  the  aperture  then  that  sample 
is  not  recorded.  The  fourth  sample  is  then  predicted  to  lie  on  the  line 
and  the  aperture  is  positioned  around  this  new  value.  In  the  event  that 
the  third  sample  fails  to  lie  in  the  aperture,  it  is  recorded  and  it  and 
the  previus  sample  value  form  the  basis  for  the  new  prediction  line. 

Figure  41  shows  the  operation  of  the  first  order  predictor. 

A  modified  first  order  prediction  method  has  also  been  used  in  past 
data  compression  programs.  In  this  technique  the  slope  of  the  predic¬ 
tion  line  is  established  as  described  above. 

However,  each  in-tolerance  data  sample  is  held  until  the  test  is 
made  on  the  next  data  sample  to  determine  whether  it  is  in-tolerance. 

When  a  sample  fails  to  lie  in  the  aperture  and,  hence  is  out  of  toler¬ 
ance,  the  previous  in-tolerance  sample  is  recorded  in  addition  to  the 
sample  which  fell  out  of  tolerance.  The  new  prediction  line  is  deter¬ 
mined  by  the  sample  just  recorded  and  the  current  sample.  In  this  way, 
whenever  an  out-of- tolerance  sample  follows  an  in-tolerance  sample,  the 
prediction  line  is  defined  by  two  actual  sample  values  rather  than  a 
sample  value  and  a  predicted  value. 

(4)  Direct  data  compressor  using  first-order  polynomial 
interpolator.  The  first  order  interpolator  is  very  similar  to  the  zero 
order  method  except  that  the  interpolations  are  made  with  respect  to 
slope.  Therefore,  straight  line  segments  connecting  recorded  values 
will  approximate  the  mean  slope  of  data  samples  over  the  time  interval 
represented  and  will  be  such  that  no  intervening  data  sample  deviates 
more  than  the  pre-set  tolerance  from  the  straight  line. 

This  method  begins  by  recording  the  first  data  sample.  A  straight 
line  is  then  drawn  between  the  first  and  third  samples.  If  the  second 
sample  is  within  an  acceptable  aperture  of  the  interpolated  value,  then 
a  straight  line  is  drawn  between  the  first  and  fourth  samples. 

The  second  and  third  samples  are  now  checked  to  determine  if  each 
of  these  values  is  within  the  prescribed  aperture.  If  at  the  Nth  sample 
value  after  the  last  transmitted  data  point,  a  line  is  drawn  and  the 
interpolated  value  differs  by  more  than  the  allowed  tolerance,  then  the 
(N  -  l)th  sample  is  considered  non-redundant  and  is  recorded.  Figure  42 
illustrates  the  first-order  interpolator. 

(5)  Direct  data  compressor  using  adaptive  techniques. 

The  previous  methods  described  use  a  fixed  procedure  for  removing  redundant 
information.  An  adaptive  predictor  responds  to  changes  in  the  data  and 
adapts  itself  accordingly  to  provide  whatever  compression  is  possible 
under  the  prescribed  ground  rules. 
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Compressor  Using  First-Order  Polynomial  Interpolator 


Adaptive  compressors  have  been  used  to  solve  the  buffer  memory 
overflow  problem.  In  periods  of  high  data  activity,  there  would  be  a 
large  number  of  non-redundant  samples  which  would  be  bused  to  the  memory 
for  storage.  If  the  buffer  memory  was  not  large  enough,  then  more  of 
the  data  samples  would  be  ]ost.  An  adaptive  system  would  correct  this 
problem  by  measuring  buffer  occupancy  and  adjusting  the  aperture  accord¬ 
ingly.  Thus,  when  the  buffer  is  nearing  overflow,  the  aperture  is 
increased  to  produce  fewer  non-redundant  samples.  The  penalty  for 
applying  this  technique  is  an  increase  in  the  end-point  to  end-point 
error  for  the  recorded  parameters  unless  a  combining  of  data  derived 
from  dynamically  related  parameters  is  used  to  maintain  the  required 
accuracy.  Keeping  in  mind  the  fact  that  aperture  sizes  used  in  the 
previously  described  data  compressors  are  established  by  the  accuracy 
required  to  perform  the  accident  investigation,  use  of  the  adaptive  data 
compression  techniques  are  recommended  only  if  the  reconstructed  signal 
accuracy  is  maintained.  Retention  of  the  required  accuracy  can  be 
achieved  by  coupling  of  dynamically  related  parameters.  For  example, 
altitude  can  be  recorded  using  an  aperture  size  of  200  feet  unless 
vertical  velocity  (from  an  accurate  source)  exceeds  500  feet/minute.  In 
this  case  altitude  can  be  recorded  using  ai  aperture  width  of  1000  feet 
and  vertical  velocities  can  be  integrated  to  obtain  altitude  during  the 
portion  of  the  flight  in  which  vertical  velocity  exceeds  500  feet/minute . 

(6)  Transformation  compressor  using  Fourier  filter.  The 
Fourier  filter  method  evaluates  the  Fourier  transform  from  a  large 
number  of  sample  points  and  has  some  merit  for  single  channel  processing. 
For  multiplex  systems,  as  in  the  case  of  the  CSFDR  system,  this  method 

is  not  considered  practical  because  of  the  tremendous  number  of  additions 
and  multiplications  necessary  to  determine  the  coefficients. 

(7)  Transformation  compressor  via  Karhunen-Loeve  method. 
This  method  is  a  generalization  of  the  Fourier-filter  technique.  Instead 
of  using  sines  and  cosines  as  the  basis  by  which  to  expand  a  function, 

an  optimum  set  (in  the  senue  of  minimum  number  of  functions  needed  to 
describe  a  signal  for  a  given  RMS  error)  is  chosen.  If  the  signal  is 
uniformly  sampled  at  a  frequency  1/T,  then  the  data  points  are  given  by: 

X(T ) ,  X(2T) , . . . ,X(nT) 

and  a  set  of  functions  are  desired  such  that 

M 

x(nT)  -  1  a.  (nT) 

i=l  1  1 


(5) 
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where 


x(nT) 


a  . 
1 


reconstructed  data  point 
coefficient  to  be  transmitted 

eigenvectors  of  the  autocorrelation 
matrix  of  the  x's 


The  M  eigenvectors  chosen  to  represent  the  data  in  equation  (5)  are 
those  which  have  the  largest  eigenvalues.  The  coefficients  a^  can  be 
found  by  taking  the  inner  product  of  the  data  points  and  the  eigen¬ 
vectors.  While  the  method  is  esthetically  interesting,  the  prohibitive 
number  of  additions  and  multiplications  for  any  reasonable  mean-square 
error  make  it  impractical,  particularly  for  the  CSFDR  system. 


(8)  Data  compression  via  parameter  extraction.  This 
form  of  data  compression  is  different  from  the  other  two  categories  in 
tr.'t  the  original  signal  cannot  be  reconstructed  from  the  reccrded 
values.  One  such  technique  is  the  quantiles  technique  in  which  estima¬ 
tions  cf  the  mean  and  standaid  deviations  can  be  made  from  the  recorded 
data.  Parameter  extraction  techniques  are  not  considered  as  viable  data 
compression  techniques  for  the  CSFDR  system  application. 

e.  Data  frame  organizations.  The  previous  paragraphs  w«  ich 
describe  the  possible  data  compressors  are  applicable  to  compression  of 
individual  parameter  waveforms.  Additional  memory  reduction  can  be 
achieved  by  optimizing  the  organization  of  the  data  in  the  CSMII  once  it 
is  determined  via  software  that  the  data  should  be  recorded. 

Commercial  crash-survivable  recorders,  which  utilize  digital  tape 
technology,  record  fixed-frame  formats  at  full  sample  rates  for  standard 
parameter  lists  in  a  continuous  recording  mode.  This  fixed-frame  format 
is  not  acceptable  for  the  A/F/T  problem  because  of  the  v^ry  high  amount 
of  memory  required  to  store  the  parameters.  For  example,  if  a  fixed-frame 
format  is  applied  to  the  parameter  list  in  table  37  at  the  sample  rates 
shown,  a  crash-survivable  memory  for  the  CSFDR  system  would  exceed 
58,612.5  words  x  16  bits  per  word  to  hold  15  minutes  worth  of  data. 

(Thic  translates  to  a  requirement  for  a  0.937  million-bit  memory.)  In 
terms  of  size,  weight,  and  cost  impact,  the  CSFDR  system  cannot  tolerate 
a  CPM  memory  requirement  of  this  magnitude. 

There  are  basically  five  kinds  of  data  frame  organizations  possible. 
These  are: 
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•  Fixed  frame 

•  Multiple  level  fixed  frame 

•  Variable  (random)  frame 

•  Multiple  level  variable  frame 

•  Combined  fixed  frame  and  variable  frame 

These  data  frame  organizations  have  been  studied  for  all  three 
services22’23’24,  and  there  is  no  need  to  duplicate  these  efforts.  The 
results  of  these  efforts,  however,  along  with  a  brief  description  of  the 
techniques,  are  summarized  in  table  38. 

The  important  poirt  to  glean  from  table  38  is  that  some  variation 
of  a  variable  (random)  frame  format  must  be  used  to  achieve  the  data 
compression  ratios  required  for  the  CSFDR  system.  Thus,  the  analysis  to 
determine  the  optimum  memory  reduction  technique  for  the  CSFDR  system 
reduces  to  selecting  the  best  combination  of  data  compressor  (for  indi¬ 
vidual  waveforms)  and  data  frame  organization. 

Although  a  variable  frame  organization  is  required  to  achieve  the 
necessary  data  compression  ratios,  it  is  difficult  to  maintain  signal 
status  and  compare  parameters  within  the  same  time  frame  when  using  a 
pure  variable  frame.  Therefore,  a  periodic  fixed  frame,  at  the  rate  of 
one  total  frame  per  minute,  is  recommended. 

f.  Measures  of  data  compression  efficiency.  Two  methods  for 
measuring  data  compression  efficiency  are  commonly  used: 

•  Sample  compression  ratio. 

•  Bit  compression  ratio. 

The  sample  compression  ratio  relates  the  number  of  non- redundant 
samples  to  the  total  number  of  samples. 


22Lloyd  N.  Baetz,  "Study  and  Design  of  Flight  Data  Recording  Systems 
for  Military  Aircraft",  Master's  Thesis,  NPS  Monterey,  California,  June 
1976. 


23Department  of  tl  Army,  "Accident  Information  Retrieval  System 
(AIRS)",  Final  Report,  AVRADCOM ,  August  1977. 

24Depariment  of  the  Air  Force,  "Development  and  Evaluation  of  L/ESS 
Data  Compression  Techniques",  Final  Report,  University  of  Dayton  Research 
Institute,  Dayton,  Ohio. 


38.  Summary  of  Potential  Frame  Formats 
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where 


CRs  =  sample  compression  ratio 

S  =  number  of  samples  transmitted  with 

compression  (identifier  included) 

S  =  number  of  samples  transmitted  without 

compression  (identifier  included) 

The  sample  compression  ratio  is  useful  in  determining  the  efficiency 
of  a  particular  data  compression  technique  for  a  given  waveform. 

The  bit  compression  ratio  takes  into  account  the  timing  information, 
which  must  be  sent  along  with  the  data,  and  is  a  true  indication  of 
overall  system  performance.  It  is  defined  as: 

B_ 

B 

c 


number  of  bits  transmitted  without 
compression 

number  of  bits  transmitted  with  compression 
The  relationship  Detween  the  two  compression  ratios  is: 


CR. 


where 


where 


CR. 

b 


CR 

s 


n^  =  number  of  bits  per  data  word 

n^  =  number  of  bits  in  time  tag 


It  is  important  to  note  that  both  compression  ratios  are  a  function 
of  the  observation  period  and  the  type  of  signal  being  recorded.  Obvi¬ 
ously,  during  periods  of  high  turbulence,  the  data  compression  ratios 
for  the  CSFDP.  system  will  be  lower  than  those  for  the  non-turbulent 
periods.  Thus,  for  highly  turbulent  flights,  the  time  history  of  the 
recorded  parameters  will  be  shorter  than  the  nominal  19  minutes,  and  for 
non-turbulent  flights,  the  time  history  of  the  recorded  parameters  will 
be  considerably  longer  than  the  nominal  19  minutes.  (See  figure  51.) 
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g.  Evaluation  of  direct  data  compression  techniques.  In 
order  to  evaluate  the  efficiency  of  the  direct  data  compression  tech¬ 
niques  described  previously,  A/F/T  sample  records  for  the  important 
parameters  listed  in  table  37  were  obtained.  The  sample  compression 
ratios  were  then  computed  for  these  parameter  recordings.  The  results, 
advantages,  and  disadvantages  are  summarized  in  table  39.  A  variable 
frame  format  was  assumed  in  all  cases,  however,  no  adaptive  data  compres¬ 
sion  techniques  were  assumed  at  this  point  although  these  techniques 
will  ultimately  be  used  in  the  finally  recommended  data  compression 
technique . 

As  table  39  shows  the  first-order  techniques  provide  the  highest 
sample  data  compression  ratios.  However,  these  techniques  are  not 
recommended  due  to  the  disadvantages  listed  in  that  table.  These  tech¬ 
niques  require  high  sample  rates.  In  the  case  of  roll  rate,  for  example, 
a  sample  rate  of  20  times/second  would  be  required  to  use  the  first-order 
techniques.  Additionally,  these  techniques  require  more  complex  airborne 
computer  programming  than  the  zero-order  techniques  and  are  awkward  to 
use  where  the  signals  are  noisy.  An  additional  program  memory  and 
scratchpad  memory  of  100  words  and  3,000  words,  respectively,  would  be 
required  for  these  techniques. 

The  fixed  aperture/zero-order  polynomial  interpolator  is  also  not 
recommended  for  the  CSFDR  system.  This  is  primarily  due  to  the  fact 
that  it  has  no  significant  advantages  over  the  floating  aperture/zero- 
order  predictor  and  it  does  not  record  actual  sample  values.  This 
technique  also  requires  a  relatively  complex  ground  data  reduction 
program. 

Therefore,  the  direct  data  compression  technique  recommended  for 
the  CSFDR  system  is  the  floating  aperture/zero-order  predictor.  As  will 
be  shown  in  the  following  sections,  this  technique  can  easily  be  coupled 
with  a  variable  frame,  periodic  fixed  frame,  and  adaptive  compressor  to 
achieve  the  data  compression  ratios  required  for  the  CSFDR  system. 

Using  the  adaptive  technique  with  dynamic  coupling  produces  results  very 
similar  to  those  of  the  first-order  techniques. 

Figures  43  through  46  show  original  and  reconstructed  profiles 
using  this  technique.  Figures  44  and  45  are  magnified  portions  of 
figure  43.  Note  that  the  reconstructed  profiles  are  step-like  in  nature. 

h.  Recommended  memory  reduction  technique  and  memory  required. 
Based  upon  the  results  of  the  preceding  sections,  the  following  memory 
reduction  technique  is  recommended  for  the  CPM: 

Aperture  technique  -  Floating 

Fundamental  equation  -  Zero-order  polynomial 
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Table  39.  Summary  of  Sample  Compression  Ratios  for  A/F/T  Parameter  Profi 


28 


First-Order  increasing/dec 

Interpolator  profiles. 

Excellent  data 


Fi f teen-minute 


ompression  Using  Floating  Aperture  and  Zero-Order  Predictor 
First  Three  Minutes  of  Airspeed  Profile 


Figure  46.  Aileron  and  Rudder  Versus  Time 


Non-redundancy  method 

Predictor 

Aperture  sizes 

Variable  and  adaptive  to 
flight  conditions  (but  always 
within  limits  required  for 
accident  investigation) 

Parameter  coupling 

Coupling  of  dynamically  rela¬ 
ted  parameters  to  further 
reduce  memory  required  and 
provide  data  compression 
effects  of  first-order  prediction 

Frame  organization 

Variable  frame  organization 
with  time  and  label  tags  where 
necessary  coupled  with  fixed 
frame  once/minute  to  maintain 
signal  status  and  integrity 

In  order  to  complete  the  memory  reduction  analysis,  parameter 
profiles  for  a  severe  turbulent  mode  of  flight  for  an  A/F/T  were  obtained. 
These  parameters  are  shown  in  figures  47  through  50  and  the  above  recom¬ 
mended  memory  reduction  technique  was  applied  to  these  parameters.  The 
parameters  represent  a  low  angle-of-attack  spin  mode  experienced  when 
full  and  abrupt  coordinated  roll,  yaw,  and  elevator  controls  are  incor¬ 
rectly  applied.  As  the  curves  show,  a  snap-roll  is  experienced  in  the 

2-10  second  portion  of  the  flight.  Following  this  period,  a  spin  is 

fully  developed  with  rapid  loss  of  altitude  and  inertial  yaw  rates  in 
the  50  degrees  per  second  range.  Actual  aircraft  flight  path  is  approx¬ 
imately  vertical  as  indicated  by  the  summation  of  angle-of-attack  and 
pitch  angles  throughout  the  spin.  The  bit  compression  ratio  obtained 
for  these  profiles,  using  the  recommended  memory  reduction  technique  was 
4.972  over  the  40-second  interval  shown.  Since  the  profiles  represent  a 
turbulent  mode,  this  ratio  is  acceptable.  Application  of  the  memory 
reduction  technique  to  the  same  parameters  for  a  non-turbulent  flight 
condition  yielded  a  bit  compression  ratio  of  16.8.  This  further  empha¬ 
sizes  the  fact  that  compression  ratios  are  a  function  of  time  and  flight 
prof i le . 

A  typical  Configuration  I  parameter  list  would  be  comprised  of  all 
the  parameters  listed  in  table  37.  The  recording  time/'memory  relationship 
is  determined  by  computing  the  number  of  bits  required  for  the  full 
Configuration  I  list,  assuming  a  two-engine  aircraft.  This  results  in 
56  signals.  Calculations  for  the  pure  turbulent,  typical,  and  pure 
cruise  modes  for  the  Configuration  I  parameter  list  are  as  follows: 
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4' 


PITCH  ATTITUDE  ANGLE  OF  ATTACK. 

(DEGREES)  (DEGREES) 


Figure  47.  Angle  of  Attack  and  Pitch  Attitude  Versus 
Time  for  Turbulent  Flight 
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SAMPLE  RATE 


2/SEC  T 


4° 


Figure  48.  Side  Slip  Angle  and  Inertial  Y3W  Rate 
Versus  Time  fcr  Turbulent  Flight 


Pure  Turbulent  Mode  Configuration  I 


Number  of  bits/minute 

number  of  bits/minute  for  fixed  frame  at 
the  rate  of  one  frame/minute  plus  the 
number  of  bits/minute  in  variable  frames 
at  turbulent  rates 

= 

(451  +  13,667)  bpm 

= 

14,118  bpm 

Typical 

Flight  Configuration  1 

Number  of  bits/minute 

number  of  bits/minute  for  fixed  frame  at 
the  rate  of  one  frame/minute  plus  the 
number  of  bits/minute  in  variable  frames 
at  typical  rates 

- 

(451  +  4,048)  bpm 

- 

4,499  bpm 

Pure 

Cruise  Mode  Configuration  I 

Number  of  bits/minute 

number  of  bits/iainute  for  fixed  frame  at 
the  rate  of  one  frame/minute  plus  the 
number  of  bits/minute  in  variable  frames 
at  pure  cruise  rates 

= 

(451  +  2083)  bpm 

= 

2,534  bpm 

For  an  8K  x  16-bit 
for  Configuration  1  are 

CPM  (131,072  bits)  the  following  recording  times 
calculated: 

Pure  turbulent 
inode  l  iiue 

= 

131,072  bits 

14,118  bpm 

= 

9.28  minutes 

Typical  flight  time 

= 

131,072  bits 

4,499  bpm 

= 

29.1  minutes 
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Pure  cruise  time 


131,072  bits 
2,534  bpm 

51.7  minutes 

These  recording  times  are  shown  in  figure  51. 

A  typical  Configuration  II  parameter  list  would  be  compriseu  of  the 
parameters  listed  in  table  37  denoted  by  an  asterisk.  The  recording 
time/memory  relationship  is  now  computed  for  the  configuration  II  list, 
assuming  a  two-engine  aircraft.  This  results  in  a  parameter  list  of 
35  signals. 


Pure  Turbulent  Mode  Configuration  II 


Number  of  bits/minute 

number  of  bits/minute  for  fixed  frame 
at  the  rate  of  one  frame/minute  plus  the 
number  of  bits/minute  in  variable  frames 
at  turbulent  rates 

= 

(319  + 

10,332)  bpm 

- 

10,651 

bpm 

Typical  Flight  Configuration  II 

Number  of  bits/minute  =  number  of  bits/minute  for  fixed  frame  at 

the  rate  of  one  frame/minute  plus  the 
number  of  bits/minute  in  variable  frames 
at  typical  rates 

-  (319  +  3,060)  bpm 

=  3,379  bpm 

Pure  Cruise  Mode  Configuration  11 

Number  of  bits/minute  =  number  of  bits/minute  for  fixed  frame  at 

the  rate  of  one  frame/minute  plus  the 
number  of  bits/minute  in  variable  frame-., 
at  pure  cruise  rates 

=  (319  +  1,575)  bpm 

=  1 ,894  bpm 
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Figure  51.  Amount  of  Recording  Time  Retained  for 
Configurations  I  and  II  Before  Memory  Wraparound  Occurs 


For  a  4K  x  16  bit  CPM  (65,536  bits)  the  following  recording  times 
for  Configuration  II  are  calculated: 


Pure  turbulent 
mode  time 


Typical  flight  time 


Pure  cruise  mode  time 


65,536  bits 
10,651  bpm 

6.15  minutes 

65,536  bits 
3,379  bpm 

19.4  minutes 

65,536  minutes 
1 , 894  bpm 

34.6  minutes 


These  recording  times  are  also  shown  in  figure  51.  The  times  in 
figure  51  represent  the  amount  of  flight  time  which  can  be  retained 
before  memory  wraparound  occurs. 


i.  Memory  endurance  calculations.  Table  40  shows  the  current 
hours  of  useage  for  the  A-10,  F-15,  and  F-16  aircraft.  These  are  typical 
for  A/F/T  aircraft. 


Table  40.  A-10,  F-15,  and  F-16 

Flight  Hours/Aircraft/Month 


AIRCRAFT 

AVERAGE  HOURS 

PER  MONTH 

A-10 

30 

F-15 

20-25 

r- 16 

20-25 

The  two  prime  memory  types  selected  are  NMOS  EE-PROM  and  MNOS  BORAM. 
These  memories  have  advertised  endurances  in  the  range  of  10s-109  erase/ 
write  cycles.  Assuming  worst  case  ( 1 0 5 )  as  the  achievable  endurance  for 
the  CPM,  and  30  hours/month/aircraft  as  the  utility  rate,  the  endurance 
is  calculated  as  follows: 
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Configuration  I 


Turbulent  Mode  (worst  case  for  memory  cycling) 


Endurance 


_ 10s  memory  cycles _ 

1800  fit,  min.  .  9.28  fit,  min. 
month  memory  cycle 

515.55  month  (or  42.96  years) 


Configuration  II 


Turbulent  Mode  (worst  case  for  memory  cycling) 


Endurance 


_ 10s  memory  cycles _ 

1800  fit,  min.  .  6.15  fit,  min. 
month  memory  cycle 

341.66  months  (or  28.47  years) 


Thus,  the  memory  endurance  exceeds  the  life  of  most  A/F/T  aircraft 
even  when  a  worst  case  calculation  is  made.  Additionally,  cycling  the 
CPM  in  the  proposed  manner  eliminates  the  need  for  replacement  of  the 
CPM  on  a  periodic  basis.  This  feature  offers  a  significant  improvement 
in  the  LCC  of  the  CSFDR  system  when  compared  to  existing  recorder  systems 
which  use  tap-?  or  metal  foil  as  the  recording  medium. 


3. 3. 2. 2  CSFDR  hardware  description  -  This  hardware  description  is 
for  the  following  three  configurations  as  described  in  the  section  C  of 
the  RFP. 

•  Operational  Configuration  II  -  minimum  number  of  flight 
parameters . 

•  Alternate  Configuration  X  -  maximum  number  of  flight 
parameters . 

•  Optional  Configuration  III  -  additional  bulk  memory 
storage . 

The  discussion  for  Configuration  II  is  given  in  detail,  whereas, 
the  paragraph  on  Configuration  I  just  briefly  describes  the  additional 
hardware  requirements  beyond  Configuration  II.  Likewise,  the  paragraph 
on  Configuration  III  shows  the  additions  to  Configuration  I. 
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a.  Hardware  description.  Operational  Configuration  II.  The 
CSFDR  hardware  description  that  follows  is  for  Operational  Configuration 
II  which  records  the  minimum  number  of  flight  parameters  of  highest 
priority.  Also,  this  write-up  will  focus  on  the  two-unit  configuration 
comprising  a  Data  Processor  Unit  and  the  Crash-Survivable  Memory  Unit. 

This  two-box  approach  is  selected  for  discussion  based  on  the  results  of 
the  installation  study.  The  study  analyzed  the  hardware  with  respect  to 
system  weight,  installation  cost,  volume  and  various  survivability 
locations  in  the  aircraft.  The  Data  Processor  Unit  (DPU)  is  located  in 
the  equipment  bay  area  where  it  has  good  accessibility  to  sensor  signals 
and  the  digital  data  bus.  The  Crash-Survivable  Memory  Unit  (CSMU)  is 
mounted  in  a  remote  area  which  has  a  higher  survivability  rate. 

The  CSFDR  system  block  diagram  is  shown  in  figure  52.  The  DPU 
interfaces  with  the  A/C  data  bus  (e.g.,  1553A/B)  when  available.  Data 
parameters  to  be  recorded  that  are  not  on  the  data  bus  will  be  received 
from  their  respective  sensors.  The  sensor  inputs  will  be  converted  to  a 
digital  format.  After  data  compression,  the  information  will  be  trans¬ 
mitted  to  the  remotely  located  CSMU. 

This  data  is  transmitted  to  and  from  the  CSMU  on  a  high-speed 
serial  channel  called  the  STD  I/O  Bus.  The  data  words  are  transmitted 
at  a  low  duty  cycle  which  prevents  internal  heating  of  the  thermally- 
insulated  memory  within  the  CSMU.  The  Data  Transfer  Module  (DTM) ,  which 
is  in  the  Air  Force  inventory,  is  a  small  non-crash-protected  data 
storage  unit.  The  DTM  uses  this  same  STD  I/O  Bus  but  at  full  duty  cycle 
for  fast  data  transfer.  If  the  DPU  has  a  second  identical  output  channel, 
then  a  DTM  can  be  used  to  retrieve  data  from  the  CSMU  via  the  DPU.  A 
third  identical  output  channel  can  be  provided  to  drive  a  bulk  memory  as 
required  in  Optional  Configuration  III.  The  STD  I/O  Bus  is  a  serial  I/O 
channel  which  minimizes  the  cable  size  and  weight  between  the  Data 
Processor  Unit  and  CSMU.  This  bus  uses  the  9614/9615  differential  line 
driver/receiver  ICs  which  are  MIL  STD  parts. 

(1)  Hardware  description  of  the  CSMU.  The  block  diagram 
for  the  CSMU  is  shown  in  figure  53.  The  circuitry  in  the  CSMU  is  divided 
into  two  areas.  The  read/write  logic  and  EE-PROM  are  protected  within 
the  thermal  insulation.  This  circuitry  dissipates  very  little  power  and 
will  now  overheat  during  normal  operation.  The  I/O  logic  containing 
9614/9615  line  drivers  and  receivers  is  located  outside  the  insulated 
region.  Also,  the  power  monitor,  which  is  a  discrete  component  design, 
is  located  outside  the  insulated  region. 

The  Crash-Survivable  Memory  Unit  incorporates  a  high-density  elec¬ 
trical  and  mechanical  packaging  design.  This  minimizes  the  volume  which 
must  be  thermally  insulated.  Based  on  the  memory  trade  study,  the 
EE-PROM  has  been  selected  for  the  non-volatile  memory  function.  A  good 
candidate  part  is  the  Hughes  HNVM  3008  which  is  low  power  and  has  a 
IK  x  8-bit  organization.  Eight  of  these  IC's  will  give  a  4K  word  x  16-bit 
nonvolatile  memory. 
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The  parallel  interface  between  the  read/write  logic  and  EE-PROM 
contains  a  large  number  of  interface  signals  (40-50)  depending  upon 
memory  size  and  organization.  Therefore,  the  read/write  logic  is  loca¬ 
ted  inside  the  thermally  insulated  region  to  minimize  the  number  of 
interconnections  passing  through  the  insulation.  The  serial  interface 
between  the  STD  I/O  logic  and  read/write  logic  is  only  about  ten  wires 
which  will  present  a  minimum  thermal  path  through  the  insulation. 

The  read/write  logic  is  a  modification  of  the  design  used  in  the 
DIM  In  order  to  achieve  minimum  size,  the  read/  write  logic  is  imple¬ 
mented  with  a  semi-custom  CMOS  LSI  (large  scale  integrated)  module  plus 
two  digital  IC'i.  The  semi-custom  is  a  600-gate  array  device  whicb 
requires  only  a  single  metalization  mask  to  interconnect  the  circuitry 
for  the  read/write  logic  design. 

The  power  monitor  in  the  CSMU  detects  a  low  voltage  condition  and 
opens  the  erase/write  line  to  the  EE-PROMs.  This  prevents  loss  of  data 
in  event  of  normal  power  shutdown,  momentary  power  loss  or  destruction 
of  cable  to  the  unit.  The  software/hardware  power  shutdown  and  startup 
sequence  is  discussed  under  the  hardware  description  for  the  Data  Pro¬ 
cessor  Unit. 


(2)  Hardware  description  of  the  DPU.  The  block  diagram 
for  the  Data  Processor  Unit  circuitry  is  shown  in  figure  54.  The  unit 
exemplifies  the  concept  of  modularity.  The  DPU  can  be  tailored  to  the 
various  aircraft,  such  as  A-10,  F-16,  and  F-15  by  changing  four  circuit 
cards  in  the  box.  The  hardware  variations  will  be  discussed  in  the 
detailed  hardware  description  that  follows. 

The  A/C  data  bus  monitoring  function  is  performed  by  the  bus  receiver 
and  bus  I/O  logic  circuitry.  This  hardware  will  change  for  each  particular 
aircraft  depending  on  the  type  of  A/C  data  bus  (e.g.,  1553A/B,  the  F-15 
data  bus).  The  bus  receiver  provides  the  transformer  coupling  to  the 
bus,  the  signal  receiver  and  digital  logic  to  process  the  data.  The  bus 
I/O  logic  contains  additional  monitor  circuitry  and  interface  to  the 
internal  microprocessor  bus.  The  bus  receiver  is  contained  on  one  card. 

The  bus  I/O  logic  needs  one  side  of  a  double-sided  logic  card. 

The  various  functions  performed  by  the  Data  Processor  Unit  are 
controlled  by  the  microprocessor  These  functions  include: 

•  Control  of  A/C  data  bus  monitor 

•  Receiving  and  storing  data  from  A/D  converter  hardware 
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Figure  52.  CSFDR  System  Block  Diagram 


Figure  53.  Crash-Survivable  Memory  Unit  Block  Diagram 


gure  54.  Data  Processor  Unit  Block  Diagram 


•  Execution  of  data  compression  algorithms 

•  Transmission  of  data  to  CSMU  via  STD  I/O  bus 

•  Transfer  of  data  from  CSMU  to  external  DRU 

•  BIT 

There  are  several  microprocessors  available.  We  have  used  the 
following  on  in-house  products:  TI9900,  8086,  and  Z8002.  These  are  all 
16-bit  machines  with  good  capabilities.  We  have  chosen  the  Z8002  for 
this  application.  This  decision  is  based  on  the  study  done  for  the  Data 
Transfer  System  which  is  a  similar  application.  The  parameters  evaluated 
for  the  trade  study  are:  power  consumption,  estimated  cost,  time  of  MIL 
TEMP  availability,  time  of  production  parts  availability,  Microprocessor 
Development  System  (MDS)  for  software  development,  multiple  vendor 
sources,  physical  size  and  instruction  execution  time.  The  microproces¬ 
sor  is  packaged  on  a  single  circuit  board  using  DIP  IC's.  This  board 
would  be  identical  with  the  Data  Transfer  System  and  each  application 
for  CSFDR  systems.  An  alternate  approach  possibility  is  to  package  the 
microprocessor  with  flatpaks,  where  available,  to  reduce  the  required 
packaging  area  to  one  side  of  the  board.  Then  another  circuit-function 
can  be  added  to  the  other  card  side.  If  the  additional  function  is 
common  to  each  version,  the  board  would  still  be  the  same  for  all  con¬ 
figurations.  However,  the  functional  modular  approach  is  compromised 
somewhat  at  the  possibility  of  reducing  card  count. 

The  Air  Force  STD  Group  is  working  toward  development  of  a  single¬ 
chip  microprocessor  to  implement  the  MIL-STD- 175CA  instruction  set.  The 
1750A  effort  is  downstream  from  this  program  and  not  available  at  this 
time . 


The  RAM/EPROM  block  provides  storage  for  the  program  which  the 
microprocessor  executes  and  also  the  temporary  scratchpad  memory.  The 
RAM/EPROM  function  is  contained  on  a  double-sided  card  based  on  the 
design  from  the  data  transfer  system.  Using  2716  UVPP.OMS  which  are 
organized  2K  x  8  will  give  a  maximum  EPROM  memory  capability  of  6K  x  16. 
This  would  allow  approximately  a  50%  growth  factor,  based  on  software 
estimates.  Only  the  number  of  memory  IC's  required  for  each  application 
would  be  installed. 

The  RAM  function  is  implemented  with  a  Lear  Siegler  hybria.  This 
board  would  be  standard  for  each  application. 

The  signal  converter  section  is  shown  in  figure  54  as  three  func¬ 
tional  blocks  located  on  two  or  three  separate  circuit  cards.  This 
partitioning  of  the  converter  section  permits  the  standardization  of 
sub-assemblies  for  various  applications.  The  A/D  converter  card  con- 
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tains  two  hybrid  microcircuits  designed  and  built  by  Lear  Siegler.  One 
is  a  successive  approximation  converter  (SAC)  which  performs  all  the 
analog  to  digital  conversions.  The  other  hybrid  microcircuit  is  the 
quadrature  reference  generator  which  monitors  the  AC  reference  voltages 
to  provide  synchronous  demodulation  of  the  AC  input  signals.  Outputs 
from  the  quadrature  reference  generator  controls  two  sample  hold  ampli¬ 
fiers.  As  an  example,  for  synchro  conversions,  the  sample  and  hold 
amplifiers  store  the  sine  and  cosine  amplitudes.  These  values  are 
multiplexed  to  the  A/D  converter  for  conversion  to  digital  numbers. 

This  board  is  general  purpose  and  is  used  in  any  application. 

The  analog  MUX  function  contains  the  AC  input  transformers,  analog 
multiplexers  and  sample/hold  amplifiers.  This  circuitry  is  tailored  for 
each  application.  Some  may  only  require  component  additions/deletions 
such  as  for  the  number  of  Scott-Tee  transformers  (synchro  inputs). 

Other  aircraft  may  require  modifications  to  the  printed  wiring  board 
network. 

The  discrete  input  function  contains  the  28-volt  discrete  to  TTL 
translators.  These  translators  are  packaged  in  an  in-house  hybrid 
microcircuit  with  four  translators  p.-r  microcircuit.  The  addition/ 
deletion  cf  components  will  tailor  this  circuitry  to  each  application 
with  probably  no  change  in  artwork 

The  signal  converter  section  is  located  on  two  circuit  cards  for 
Configuration  II  (minimum  number  of  flight  parameters).  Three  cards 
will  be  assumed  for  Configura'  ion  I  (maximum  number  of  flight  param¬ 
eters)  . 

The  STD  I/O  bus  driver  functions  are  located  on  one  side  of  the  bus 
I/O  logic  card.  This  function  is  identical  for  each  application.  An 
additional  bus  driver  can  be  placed  on  this  card  to  implement  Configu¬ 
ration  III.  This  output  would  drive  the  mass  storage  unit. 

The  power  supply  in  the  Data  Processor  Unit  accepts  aircraft  power 
for  conversion  to  logic  power,  analog  power  and  EE-PROM  erase/write 
power.  The  only  voltage  which  is  heavily  loaded  is  the  +5  VDC  logic 
power.  A  switching  mode  regulator  is  used  for  logic  power  to  minimize 
power  losses,  size,  and  weight.  The  lightly  loaded  voltages  use  mono¬ 
lithic  integrated-circuit  regulators.  The  linear  regulators  provide 
minimum  size  and  weight  for  light  loads.  The  voltage  regulators  are 
contained  on  a  full-size  chassis-mounted  circuit  card.  The  input  trans¬ 
former  and  rectifier  diodes  are  contained  on  a  half-size  chassis-mounted 
circuit  card  in  the  case  of  AC  input  power. 

The  type  of  aircraft  input  power  to  the  DPU  will  depend  on  the 
particular  aircraft  involved.  A  bus  with  emergency  generator  or  battery 
backup  such  as  F-16  battery  bus  may  be  desirable.  This  would  allow  the 
CSFDR  system  to  continue  recording  after  a  main  generator  failure. 
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The  regulator  card  also  contains  the  power-down  detection  circuitry. 
Upon  detection  of  the  beginning  of  a  power  transient  or  complete  shutdown, 
a  power-down  interrupt  (PDI)  is  sent  to  the  microprocessor.  After  the 
PDI  is  issued  the  power  supply  has  capacitance  to  maintain  regulation 
for  over  100  milliseconds.  During  this  period  the  microprocesor  will 
load  current  address  and  time  into  the  CSMU's  EE-PROM.  A  master  reset 
(MR)  is  issued  at  a  specified  time  after  the  PDI  and  also  when  power 
comes  up.  At  the  end  of  MR  the  microprocessor's  start-up  routine  will 
recall  the  EE-PROM  address  and  begin  loading  parameters  at  this  location 
in  the  protected  memory.  This  procedure  prevents  data  in  the  EE-PROM 
from  being  overwritten  and  destroyed  on  microprocessor  start-up  after  a 
power  transient  or  shutdown. 

A  card  slot  is  provided  in  the  Data  Processor  Unit  for  the  test 
monitor  interface  card.  This  card  allows  a  CRT  terminal  and  test  set  to 
be  connected  to  the  DPU  bus.  The  interface  card  contains  a  test  program 
which  the  operator  can  use  to  test  the  DPU  and  CSMU. 

Built-in  Test  (BIT).  The  Data  Processor  Unit  maintains  a  modular 
design  with  a  microprocessor  controlling  all  the  functions.  This  allows 
the  microprocessor  to  efficiently  and  comprehensively  perform  a  self-test 
check  on  the  hardware.  The  microprocessor  can  interrogate  the  CSMU  on 
the  two-way  STD  I/O  bus  to  confirm  read/write  capability  to  the  EE-PROM. 

The  analog  conversion  hardware  can  be  checked  by  including  two 
reference  voltage  inputs  on  the  analog  MUX  board.  The  BIT  subroutine 
commands  the  A/D  converter  to  sample  and  convert  these  positive  and 
negative  references  on  a  periodic  basis. 

A  watchdog  timer  is  used  to  detect  software  hangups  and  other 
periodic  function  failures. 

A  BIT  failure  signal  is  provided  from  the  DPU  to  annunciate  the 
Master  Caut iou/Telel ight  Panel  if  a  failed  condition  is  detected. 
Additional  failure  indicators  can  be  mounted  on  the  DPU  to  differentiate 
between  DPU  and  CSMU  failures. 

DPU  chassis  description.  The  DPU  chassis  is  shown  in  figure  55. 

The  basic  chassis  construction  uses  aluminum  plates  and  access  covers 
mechanically  assembled  using  machine  screws.  The  chassis-mounted  inter¬ 
face  connectors  are  located  on  the  front  plate  along  with  the  input 
transformer  (if  required)  dust  cover.  The  front  plate  also  holds  required 
BIT  failure  indicators.  The  power  supply  regulator  card  is  mounted  just 
above  the  bottom  access  cover.  The  second  power  supply  card  which  holds 
the  input  circuitry  is  mounted  behind  the  front  plate.  The  sides  are 
machined  plates  with  card  guides  to  hold  the  plug-in  circuit  cards.  An 
extra  card  slot  is  provided  for  the  test  interface  card.  An  adhesively 
bonded  chassis  will  be  utilized  for  high  volume  production. 
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The  chassis  would  be  designed  to  hold  seven  plug-in  boards  for 
Configuration  I  (maximum  number  of  flight  parameters  recorded).  A 
smaller  ihassis  to  hold  six  plug-in  circuit  cards  is  required  for  Con¬ 
figuration  II  (minimum  number  of  flight  parameters  recorded). 

b.  Hardware  description.  Alternate  Configuration  I.  This 
version  of  the  CSFDR  system  will  record  the  maximum  number  of  flight 
parameters  for  the  longest  practical  time  before  recycling.  The  fol¬ 
lowing  description  gives  the  modifications  to  the  basic  Configuration  II 
hardware  in  order  to  record  the  maximum  parameter  list  of  Configuration  I. 
The  first  change  is  an  increase  in  size  of  the  Crash-Survivable  Memory 
Unit's  (CSMU)  nonvolatile  memory.  The  memory  comprised  of  IK  x  8  EE-PROM 
integrated  circuits  is  increased  from  4K  words  x  16  bits  to  8K  x  16  bits. 

The  Data  Processor  Unit  (DPU)  has  several  changes  for  Configura¬ 
tion  I.  Another  circuit  board  is  needed  in  the  DPU  which  increases  the 
card  count  to  seven  plug-in  circuit  boards.  This  card  expands  the  input 
signal  converter  section  and  contains  signal  conditioning  circuitry  for 
the  additional  flight  parameter  inputs. 

c.  Hardware  Description.  Optional  Configuration  III.  This 
CSFDR  system  will  record  the  maximum  parameter  list  as  in  Configuration  I 
and  also  features  a  nonvolatile  bulk  memory.  The  mass  storage  unit  (MSU) 
will  contain  256-K  words  x  16  bits  of  EE-PROM.  An  additional  standard 
I/O  bus  in  the  Data  Processor  Unit  will  provide  the  interface  between 
the  MSU  and  DP'J.  The  software  program  will  be  modified  in  the  DPU  to 
control  the  I/O  channel  to  the  mass  storage  unit. 

The  MSU  will  be  composed  of  groups  of  EE-PROM  packages.  Each 
memory  block  will  be  interfaced  by  two  CMOS  semi-custom  gate  arrays. 

This  is  an  extension  of  the  design  approach  used  for  the  Ctash-Survivable 
Memory  Unit.  Where  the  CSMU  is  just  one  block  of  EE-PROMs  driven  by  a 
single  gate  array.  Using  low  power  EE-PROMs  and  CMOS  gate  arrays  provides 
very  low  power  dissipation  for  the  mass  storage  unit. 
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gure  55.  DPU  Chassis 


3-3.3  Software/ firmware  development  -  The  primary  purpose  of  this 
section  is  to  establish  a  base  for  estimating  software/firmware  develop¬ 
ment  costs  and  costs  for  maintaining  it  in  use. 

The  analytical  approach  and  hardware  required  fo  :  the  analytical 
approach  were  described  in  the  preceding  sections.  This  section  describes 
the  software/firmware  development  needs  of  the  CSFDR  system. 

The  airborne  software  program  will  reside  in  the  EPROM  portion  of 
the  DPU  and  will  be  executed  under  microprocessor  control.  A  RAM  is 
also  required  for  intermediate  calculations  and  other  temporary  storage 
functions.  The  primary  software  functions  are 

•  Data  Conversion 

■  Data  Processing/Data  Compression 

•  Airborne  BIT 

•  Miscellaneous  functions  such  as  Readout  Interface, 

Maintenance  Interface,  etc. 

3 . 3 . 3 . 1  Airborne  EPROM  requirements 

a.  Data  Conversion  Routines.  Control  of  the  discrete  multi¬ 
plexer,  analog  multiplexer  and  A/D  converter  is  provided  by  a  functionally 
modular  software  program.  The  conversion  rates  are  determined  from  the 
sample  rates  shown  in  table  37.  These  rates  range  from  eight  samples 
per  second  to  one-fourth  sample  per  second.  For  a  standard  CSFDR  system, 
the  following  conversion  routines  are  required: 

Syn  hro/Resd ver/LVDT  to  Digital 

DC  to  Digital 

AC  to  Digital  (Non-synchro) 

Frequency  to  Digital 

Discrete  to  Digital 

Aircraft  MUX  Bus  Interface  (1553,  and  others) 

It  should  be  noted  that  a  particular  aircraft  will  not  require  all 
of  the  above  conversion  routines.  However,  for  a  standard  CSFDR  system 
which  can  be  applied  ». *>  old  and  new  aircraft  these  conversion  routines 
will  be  required.  Additionally ,  they  are  required  for  tri-service 
standardization. 
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.For  the  synchro-type  inputs,  a  value  of  sin  0  and  cos  9  are  presented 
for  each  sampled  parameter.  The  arc  tangent  subroutine  converts  these 
two  inputs  into  a  digital  word  representing  0  in  radians  or  degrees. 

Also,  as  described  in  section  3.3.2,  a  successive  approximation  converter 
is  used  for  analog  to  digital  conversions. 

The  A/C  Data  Bus  software  program  handles  the  job  of  monitoring  the 
data  bus  for  particular  flight  data  parameters.  The  program  compares 
terminal  address  and  subaddress  of  incoming  command  words  to  preselected 
values  stored  in  the  software  program.  When  a  correct  address  is  identi¬ 
fied,  the  following  flight  data  parameters  are  stored  for  processing  by 
the  data  compression  software.  Approximately  a  985-wora  software  module 
is  needed  to  interface  with  the  data  bus  based  on  a  similar  program  at 
Lear  Siegler,  Inc.  called  the  Data  Transfer  System. 

The  EPRCM  required  for  the  data  conversion  routines,  described  in 
the  preceding  paragraphs,  is  summarized  in  table  41.  These  routines  are 
off-the-shelf  routines  and  therefore  the  word  counts  are  very  accurate. 

The  routines  have  been  developed  at  Lear  Siegler  for  the  Performance 
Navigation  Computer  System  Pregram  and  the  Data  Transfer  System  Program. 


Table  41.  Summary  of  Required  EPROM 


DATA  CONVERSION  ROUTINE 

16  BIT  WORDS  OF  EPROM  REQUIRED 

Synchro/Resolver/LVDT  to  Digital 

DC  to  Digital 

AC  to  Digital 

Frequency  to  Digital 

Discrete  to  Digital 

960  words 

Aircraft  MUX  Bus  Interface 
( 1553/F-15) 

985  words 

Arc  Tangent  Subroutine 

150  words 

Data  Conversion  Executive 

100  words 

Total  EPROM  for 

2,195  words 

Data  Conversion 
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b.  Data  Processing/Data  Compression.  After  the  input 
parameters  are  converted  to  a  digital  word,  they  are  placed  into  a  table 
within  the  RAM  ("scratchpad").  The  data  compression  software  then 
compares  the  table  values  to  the  table  of  last  recorded  values  which  are 
also  held  in  RAM  after  they  have  been  transmitted  to  the  CSMU.  Current 
aperture  sizes  and  dynamically  coupled  parameters  are  checked  to  deter¬ 
mine  whether  or  not  the  recently  sampled  values  are  redundant.  If  they 
are  redundant  they  are  not  recorded  in  the  CSMU.  If  they  are  not  redundant, 
the  WRITE  CSMU  subroutine  is  called  and  an  output  message  is  formatted 
in  order  to  write  the  non-redundant  paramete-s  into  the  CSMU.  Only  the 
non-redundant  parameters  are  recorded  in  the  CSMU. 

The  actual  output  messages  are  comprised  of  labels,  time,  and  data 
as  shown  in  figure  56.  Data  word  strings  varying  from  one  to  thirty-two 
words  can  be  transmitted  to  the  CSMU  within  a  single  data  burst. 

Optionally,  it  may  be  desirable  to  know  actual  peak  values  and 
total  time  above  certain  limits  for  selected  parameters.  Parameters 
which  could  use  this  format  include  accelerations  (especially  vertical), 
angular  rates  (especially  roll),  and  engine  RPMs.  In  this  format,  if 
specified  limits  are  exceeded,  successive  values  are  checked,  and  peak 
values,  together  with  the  time  interval  in  which  the  parameter  remained 
above  this  limit,  are  transmitted  to  the  CSMU.  This  format  is  shown  in 
figure  57. 

In  addition  to  the  variable  frame  formats,  a  fixed  frame  of  data  is 
recommended  in  order  to  maintain  signal  integrity.  Formats  for  the 
fixed  frame  are  shown  in  figure  58.  Parameters  which  are  common  to 
Configuration  I  and  II  maintain  identical  labels  in  both  configurations. 

Actual  writing  of  data  into  the  CSMU  is  also  under  EPROM  program 
control.  This  includes  erasing  of  old  data,  writing  of  new  data,  and 
verification  of  write  operation.  However,  actual  writing  of  data  into 
the  CSMU  must  be  done  efficiently  in  order  to  (1)  increase  the  actual 
reliability  of  the  system,  and  (2)  maximize  the  useful  life  of  the  CPM. 
Therefore,  an  inhibit  on  writing  into  the  CSMU  is  provided  as  a  function 
of  certain  parameters.  The  parameters  used  to  provide  inhibit  are  squat 
switch  position/engine  RPM(s).  If  these  parameters  indicate  that  the 
aircraft  has  landed,  recording  is  stopped  after  a  suitable  time  delay. 


[essage  Formats 


PARAMETER (S) 


LABEL(S) 


Synchronization 

h/A 

Time  (minutes) 

0 

0 

0 

0 

0 

0 

1 

0 

CAS 

0 

0 

0 

0 

0 

0 

1 

1 

Fuel  flow(s) 

0 

0 

0 

0 

0 

1 

0 

0 

-  0 

0 

0 

0 

0 

1 

0 

1 

Altitude 

0 

0 

0 

0 

0 

1 

1 

0 

Engine  RPM(s) 

0 

0 

0 

0 

0 

1 

1 

1 

-  0 

0 

0 

0 

1 

0 

0 

0 

Roll 

0 

0 

0 

0 

1 

0 

0 

1 

Pitch 

0 

0 
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Figure  58.  Fixed  Frame  Format 
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Non-catastrophic  incident  data  can  be  handled  in  either  of  three 

ways : 

•  Store  the  information  in  a  DTM  located  in  the  cockpit. 

•  Store  the  information  temporarily  in  the  scratchpad 
memory  of  the  DPI),  then  dump  this  information  into 
the  CSMU  automatically  after  landing. 

•  Inhibit  rewrite  of  a  block  of  CPM  memory  after  at. 
incident  so  that  if  wraparound  were  to  occur,  this 
portion  of  the  CPM  would  be  skipped  over  and,  there¬ 
fore,  preserved. 

Although  these  methods  are  left  as  options,  the  first  method  is  the 
preferred  method.  This  method  simply  involves  removing  the  DTM  after 
the  flight  and  "plugging"  it  into  a  readout  station.  The  ground-based 
software  will  then  reconstruct  the  parameters  immediately  preceding  and 
during  the  non-catastrophic  incident. 

The  data  processing/data  compression  software  approach  provides 
flexibility  needed  for  the  CSFDR  system.  For  example,  as  the  aircraft 
ages,  it  may  become  desirable  to  reprioritize  the  parameter  list  and 
perhaps  add  certain  parameters.  Since  the  approach  taken  is  under 
software  control,  a  modified  airborne  program  can  be  generated  in  a  very 
short  period  of  time.  Additionally,  the  mo'ified  program  can  be  gen¬ 
erated  by  the  USAF  alone  or  by  a  USAF/LSI  team. 

The  data  process ing/data  compression  software  also  performs  the 
basic  bookkeeping  functions  of  the  CSFDR  system.  vhese  include  comput¬ 
ing  elapsed  time,  and  CSMU  address  tracking. 

Elapsed  time  is  kept  by  the  internal  software  clock  which  auto¬ 
matically  resets  to  zero  at  power  turn-on.  During  temporary  power  loss 
the  present  elapsed  time  in  minutes  is  stored  in  the  CSMU.  When  power 
is  recovered,  the  elapsed  time  in  minutes  is  read  from  the  CSMU  in 
addition  to  the  last  address  written  into.  The  seconds  portion  of  the 
elapsed  time  is  reset  to  zero. 

Table  42  shows  the  EPROM  required  for  the  data  processing/data 
compression  routines. 
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Table  42.  EPROM  for  Data  Processins/Data  Compression 


DATA  PROCESSING/DATA 

COMPRESSION  ROUTINE 

16-BIT  WORDS  OF  EPROM 

REQUIRED 

Data  Compression 

365 

Write  CSMU 

60 

Bookkeeping 

70 

DP/DC  Executive 

50 

Total  EPROM  for  DP/DC 

545  words 

c.  Airborne  BIT  Software.  The  BIT  software  is  critical  in 
reducing  the  LCC  since  it  directly  reduces  the  maintenance  actions 
required  to  verify  operation  on  a  periodic  basis.  The  microprocessor 
within  the  DPU  efficiently  and  comprehensively  performs  the  self-test 
checks  on  the  hardware  elements  of  the  total  CSFDR  system.  Analog, 
discrete,  and  MUX  bus  test  signals  are  generated  as  reference  voltages 
and  the  BIT  subroutine  commands  the  interface  electronics  to  sample  and 
convert  these  positive  and  negative  references  on  a  periodic  basis. 
Moreover,  the  microprocesser  interrogates  the  CSMU  on  a  two-way  standard 
I/O  bus  to  confirm  read/write  capability  of  the  CPM.  EPROM  values  are 
also  periodically  summed  and  compared  to  stored  values.  In  turn,  these 
values  are  checked  in  segments  of  RAM  to  assure  RAM  read/write  capability. 
A  watchdog  timer  also  is  used  to  detect  software  hangups  and  other 
periodic  function  failures. 

A  test  program  which  utilizes  all  of  the  microprocessor  instruc¬ 
tions  is  also  recommended. 

Finally,  unrealistic  changes  of  sensor  inputs  and  sensor  limits  may 
be  flagged  within  the  BIT  software. 

Depending  upon  the  particular  type  of  aircraft  in  which  the  CSFDR 
system  is  installed,  a  BIT  failure  signal  is  provided  from  the  DPU  to 
annunciate  the  Master  Caution/Telelight  Panel  whenever  a  failed  condition 
is  detected. 


316 


In  summary,  the  following  BIT  checks  are  made. 

(1)  Analog,  discrete,  MUX  input  compared  to  references. 

(2)  CSMU  read  after  write  verify  including  standard  I/O 

bus  operation. 

(3)  EPROM  values  summed  and  compared  to  references. 

(4)  RAM  address  operative  and  verified  sequentially  in 
wraparound  procedure. 

(5)  Watchdog  timer  used  to  detect  periodic  function 
failures  and  software  hangups. 

(6)  Test  program  to  exercise  microprocessor  instruction 


set. 

(7)  Sensor  inputs  checked  for  validity. 

The  EPROM  required  to  perform  the  BIT  Function  is  approximately  200 
words.  The  BIT  software  is  extremely  similar  to  existing  BIT  programs 
used  at  LSI  for  many  production  digital  computer  models,  and  therefore 
provides  an  accurate  estimate  of  words  required. 


d.  Miscellaneous  software  functions.  Additional  software 
functions  are  required  for  (1)  Portable  Data  Retrieval  Unit  interface 
and  (2)  Maintenance  Equipment  interface. 


The  retrieval  software  subroutine  is  initialized  when  the  cable  is 
connected  to  the  DPU  and  the  start  push  button  is  depressed.  This 
generates  a  load  discrete  signal  which  halts  the  normal  program  and 
begins  execution  of  the  retrieval  subroutine.  The  retrieval  subroutine 
sequentially  "dumps"  the  CSMU  contents  onto  the  DTM  and  during  the 
"dump"  process  the  microprocessor  illuminates  the  busy  indicator  lamp  on 
the  DRU.  A  BIT  procedure  is  used  to  read  each  word  back  from  the  DPU 
and  compare  it  with  the  word  just  loaded  to  check  the  integrity  of  the 
DRU.  When  the  data  transfer  operation  is  complete,  the  busy  indicator 
lamp  is  turned  off.  The  EPROM  required  to  perform  the  DRU  interface  is 
conservatively  estimated  at  SO  words. 
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The  memory  required  for  the  Self-test  Program  (STP)  used  by  the  GSE 
is  contained  on  the  Test  Set  Interface  Board.  This  board  also  contains 
the  RAM  scratchpad  used  by  the  DPU  microprocessor  while  executing  the 
STP.  Although  this  program  is  not  resident  in  the  DPU  (an  airborne 
unit),  it  does  impact  the  LCC  of  the  overall  CSFDR  system.  The  STP 
program  is  estimated  to  be  6000  words,  based  upon  similar  programs  at 
Lear  Siegler,  Inc. 

e.  EPROM  Totals.  The  EPROM  totals  required  for  Configura¬ 
tions  I  and  II  are  summarized  below  in  table  43.  The  preceding  discus¬ 
sion  applied  to  Configuration  I,  and,  therefore,  a  slight  reduction  is 
seen  in  the  airborne  program  for  Configuration  II.  The  PROM  required 
for  the  STP  used  by  the  GSE  is  also  shown  below.  The  additional  EPROM 
required  to  process  the  parameters  for  expanded  recording  (Section 
3.2.4)  is  estimated  at  260  words  above  that  required  for  Configuration  I. 


Table  43.  Program  Memory  Totals 


Airborne  EPROM 

Words  For 

Words  For 

Requirement 

Configuration  I 

Configuration  II 

Data  Conversion 

2,195  words  x  16  bits 

2,135  words  x  16  bits 

Data  Processing/Data 

545  words  x  16  bits 

495  words  x  16  bits 

Compression 

BIT 

200  words  x  16  bits 

170  words  x  16  bits 

Misc.  Software 

50  words  x  16  bits 

50  words  x  16  bits 

Master  Executive 

150  words  x  16  bits 

150  words  x  16  bits 

Total  EPROM 

3,140  words  x  16  bits 

3,000  words  x  16  bits 

STP 

6,000  words  x  16  bits 

Since  the  DPU  board  which  contains  the  airborne  software  program 
can  accommodate  6,000  words  x  16  bits,  adequate  growth  capability  for 
both  Configurations  I  and  II  is  provided. 

3. 3. 3. 2  Airborne  RAM  requirements  -  The  RAM  of  the  CSFDR  system  is 
used  for  temporary  storage  of  dynamic  data  and  as  a  CSMU  memory  buffer, 
it  performs  the  following  functions: 

(1)  Stores  old  and  new  tables  of  parameter  values. 
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(2)  Stores  time  for  fixed  and  variable  frames. 

(3)  Stores  current  aperture  sizes  for  each  parameter  and 
the  parameter  status. 

(4)  Stores  "peaks  and  valleys"  of  selected  parameters. 

(5)  Stores  "non-catastrophic  incident"  data. 

(6)  Stores  address  of  certain  data. 

(7)  Stores  intermediate  results  of  calculations  required 
in  Data  Conversion,  Data  Processing/Data  Compression,  BIT,  and  ether 
miscellaneous  functions. 

The  RAM  required  to  perform  these  functions  is  1711  words  x  16  bits 
and  1515  words  x  16  bits  for  Configurations  1  and  II,  respectively. 
Therefore,  to  provide  growth  capability,  a  2K  x  16  bit  RAM  is  recom¬ 
mended  for  the  production  versions  of  the  CSFDR  system. 

3. 3. 3. 3  Airborne  microprocessor  throughput  -  Berore  selecting  the 
microprocessor  for  the  CSFDR  system,  a  throughput  approximation  was 
made.  This  is  required  in  order  to  avoid  the  processor  saturation 
problem  which  could  arise  if  a  very  slow  microprocessor  were  selected. 

As  is  the  case  with  data  compression  ratios,  actual  microprocessor 
throughput  is  not  a  constant.  Actual  throughput  j  >  a  function  of  time, 
types  of  sensors  used,  and  mode  of  CSFDR  system  operation. 

fhe  microprocessor  operations  required  for  the  CSFDR  system  are 
relatively  simple  when  compared  to  the  operation  required  by  a  more 
complex  avionics  problem  such  as  navigation  or  weapon  delivery.  The 
CSFDR  system  operations  are  comprised  primarily  of  addition/subtractions, 
read/write  strings,  logicals,  and  multiplications.  Very  few  divides  are 
required. 

In  order  to  execute  the  airborne  program  described  in  section  3.3.3. 1, 
throughputs  of  23,286  OPS  and  18,246  OPS  are  required  for  Configurations  I 
and  II,  respectively. 

Because  the  CSFDR  system  instructions  are  relatively  simple,  the 
avionics  standard  instruction  mix  of  80  adds/20  multiplies  can  be  con¬ 
servatively  used  to  determine  the  throughput  capability  of  the  selected 
microprocessor.  The  additions  arc  further  divided  into  40  memory-to- 
register  adds  and  40  register-to-register  adds. 
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40 


mem-reg  adds 
40  reg-reg  adds 
20  mult. 


OPS 


40  (8  x  0.25  psec) 
40  (4  x  0.25  psec) 
20  (72  x  0.25  psec) 

100  operations 


80  (sec 
40  psec 
360  psec 
480  psec 


,  100  operations  .  .10b  psec. 

480  psec  sec 

208,333  operations/sec 


This  rating  of  208,333  OPS  for  the  selected  microprocessor  compares 
favorably  with  the  23,286  OPS  and  18,246  OPS  required  for  CSFDR  system 
normal  operation.  Even  with  a  100%  growth  requirement  in  throughput, 
the  selected  microprocessor  is  operating  far  below  its  saturation  level. 


3. 3. 3. 4  Ground-based  software 


a.  Software  language  selection.  Although  there  are  three 
excellent  candidates  for  the  readout  facility,  section  3.2.6  states  that 
the  Norton  AFB  data  processing  facility  be  considered  as  the  primary 
ground-based  facility  for  the  CSFDR  system  support.  This  data  processing 
facility  now  utilizes  an  IBM  360/155  mainframe  in  conjunction  with 
0S/VS1.  Preferred  software  languages  in  order  of  preference  for  this 
facility  are: 


•  Fortran  IV 

•  C0BAL 

Both  of  these  languages  are  listed  in  D0D  5000.31  as  acceptable 
standard  languages  for  ground-based  facilities.  However,  Fortran  IV  is 
considered  to  be  more  acceptable  for  this  application.  Therefore,  it  is 
recommended  that  all  of  the  software  described  in  the  following  para¬ 
graphs  of  this  section  be  written  in  Fortran  IV. 
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b.  Software  layout.  The  ground-based  software  will  provide 
plots  of  parameters  vs.  time,  groups  of  appropriately  coupled  parameters 
vs.  time,  dynamic  reconstruction  of  accident/mishap  for  CRT  display, 
parameter  synthesis,  cross  correlation,  analysis,  and  general  documenta¬ 
tion  for  a  host  of  applications  important  to  the  USAF.  A  layout  of  the 
software  required  is  shown  in  figure  59  as  it  would  be  installed  at 
NAFB . 


The  time  and  date  of  the  accident  (when  known),  aircraft  type  and 
tail  number,  local  environmental  factors  at  the  accident  time  (when 
known),  and  program  options  desired  are  manually  input  to  the  support 
software  system.  Additional  input  data  comes  from  the  CSFDR  systems’ 
survivable  memory.  The  inputs  are  then  processed  in  order  to  convert 
the  relative  time  recordings  to  real  time  (the  data  is  uncompressed). 

This  step  is  then  followed  by  a  credibility  analysis  of  the  uncompressed 
data  in  a  manner  similar  to  that  currently  used  by  the  NTSB.  Range  and 
range  rate  limits,  correlation  with  input  data,  and  correlation  of 
multiple  source  data  is  made.  The  next  step  consists  of  converting  the 
raw  data  to  engineering/scientific  units  and  storing  this  converted  data 
on  a  disk/tape  file.  This  file  then  becomes  the  data  base  for  the 
outputs  to  be  used  in  the  accident  investigation.  The  outputs  are 
briefly  described  in  the  following  paragraphs. 

(1)  Individual  parameter  plots  vs.  time.  Any  individual 
parameter  plot  may  be  requested  by  the  accident  investigation  team. 

These  single  parameter  plots  would  have  the  appearance  of  the  recovered 
plots  shown  in  figures  47  through  50. 

(2)  Group  parameter  plots  vs.  time.  Groups  of  parameters 
may  also  be  desired  by  the  accident  investigation  team.  These  multiple 
parameter  plots  would  appear  as  shown  in  figure  60. 

(3)  Table  of  parameters  vs.  time.  A  table  of  parameters 
vs.  time  may  also  be  requested  as  a  program  option.  Any  giver,  parameter 
or  group  may  be  requested  as  desired  by  the  accident  investigation  team. 
All  parameters  will  be  listed  in  engineering/scientific  units  in  the 
time  sequence  in  which  they  occurred.  Additionally,  any  given  block  of 
time  may  be  isolated  and  requested.  This  permits  the  accident  investi¬ 
gation  team  to  focus  upon  a  particular  segment  of  the  flight.  The 
format  is  shown  in  table  44. 
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TAIL  NUMBER 


59.  Ground-based  Software  Layout 
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Figure  60.  Multiple  Parameter  Plots 

(4)  Dynamic  reconstruction  of  accider.t/mishap .  The  manual 
inputs  and  recorder  inputs  provide  all  of  the  data  required  to  dynam¬ 
ically  re  corstruct  the  accident/mishap.  A  program  option  to  display  the 
actual  aircraft  motii  as  a  function  of  time  along  with  a  digital  dis¬ 
play  of  pertinent  parameters  is,  therefore,  recommended.  Toe  parameters 
displayed  digitally  can  be  selected  as  desired.  Figure  61  shows  an 
example  of  this  option.  The  dynamic  reconstruction  may  be  stopped 
(frozen)  at  any  given  point  in  time,  or  reversed,  in  order  to  provide 
the  accident  investigator  with  a  "snapshot"  capability.  Additionally, 
suspect  parameters  or  known  failures,  may  appear  as  blinking  elements  on 
the  CRT. 
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Table  44.  Parameters  Vs.  Time 


Figure  61.  Dynamic  Reconstruction  of  Accident/Mishap 


(5)  Parameter  synthesis.  Many  parameters  can  be  derived 
from  related  parameters  and  therefore  used  in  additional  ground  support 
software  subroutines.  Heading,  roll  and  pitch  can  be  used  to  compute 
roll,  yaw,  and  pitch  rates.  Vertical  velocity  can  be  used  to  compute 
altitude  or  instantaneous  normal  acceleration.  Certain  control  surface 
positions  can  be  computed  from  pilot  inputs  and  aerodynamic  data. 

(6)  Parameter  cross-correlation  and  coupled  plots.  This 
subroutine  is  intended  to  be  used  as  an  investigative  technique.  Control 
inputs  may  be  correlated  with  airframe  responses.  For  example,  power 
lever  angle  changes  can  be  correlated  with  longitudinal  acceleration. 

Stick  input  can  be  correlated  with  pitch  and  roll  responses.  Rudder 
pedal  can  be  correlated  with  yaw  angle  rate.  This  subroutine  may  also 

be  programmed  in  a  flight  simulator  for  comparative  analysis  purposes. 

In  cases  where  pilot  error  is  the  probable  cause  of  the  accident/mishap, 
additional  pilots  can  be  presented  with  the  same  situation,  in  the 
simulator,  to  determine  their  response.  Such  procedures  may  ultimately 
result  in  technical  order  changes  or  changes  in  basic  operating  procedures. 

(7)  Documentation.  In  addition  to  the  basic  data  which 
will  be  permanently  stored  on  the  disk  or  tape  file,  documentation  data 
which  results  from  any  of  the  previous  subroutines  may  also  be  permanently 
stored  via  program  request.  This  information  may  be  recalled  at  a  later 
point  in  time  and  incorporated  into  the  accident/mishap  report  as  desired. 
Additionally,  as  a  library  is  accumulated,  this  data  can  be  made  avail¬ 
able  for  fleetwide  studies  throughout  the  USAF. 

c.  Ground  support  program  size.  The  ground  support  software 
programs  are  estimated  at  41,200  words  x  16  bits.  These  programs  will 
be  written  in  Fortran  IV  and  the  cost  per  word  to  develop  these  programs 
is  considerably  less  than  the  cost  per  word  to  develop  the  airborne 
program. 


3.4  Alternate  configuration  life  cycle  cost  (LCC)  estimates 

(Detailed  inputs  for  this  section  are  in  appendices  G  and  H.) 

Life  cycle  cost  estimates  have  been  derived  for  three  different 
configurations  of  the  Crash-Survivable  Flight  Data  Recorder.  Each  LCC 
estimate  is  an  accumulation  in  FY  '80  dollars  of  development  cost, 
acquisition  cost,  and  support  cost  for  a  20-year  operation  period. 

a.  LCC  model.  The  LCC  analysis  was  performed  by  using  the 
TI-59  handheld  calculator  LCC  model  developed  by  the  ASD/AFALD  LCC/DTC 
Advisory  Group.  The  model,  which  is  an  adaptation  of  the  USAF  Logistic 
Support  Cost  (LSC)  model,  is  included  in  appendix  G. 

LSI  has  considerable  experience  using  the  TI-59  model.  This  LCC 
model  has  been  used  by  LSI  for  deriving  life  cycle  costs  for  other  USAF 
programs.  These  programs  include  the  Low-cost  Inertial  Guidance  System 
(LCIGS)  Program,  the  AWACS  AHRS  Replacement  Study,  and,  presently,  the 
Fuel  Savings  Advisory  System  (FSAS)  Program,  which  is  in  its  proposal 
phase. 


The  cost  equations  of  the  USAF  LSC  model  which  are  related  to  the 
spares  and  support  cost  equations  of  the  TI-59  model  have  also  bee',  used 
in  the  Support  Cost  Guarantee  (SCG)  Program  for  LSI's  I-4E  Aircraft 
Digital  Modular  Avionics  System  (AN/ARN-101 ) . 

LSI  feels  this  TI-59  LCC  model  is  appropriate  for  the  CSFDR  system 
study.  The  CSFDR  system  design  is  similar  at  the  shop-replaceable-unit 
(SRU)  level  to  cards  that  have  been  designed  as  part  of  systems  for 
other  programs.  This  has  permitted  the  use  of  this  detailed  model 
rather  than  parameter  cost  estimating  relationships.  Since  SRU  config¬ 
urations  can  be  approximated  very  well,  the  related  production  costs  can 
be  determined.  The  mean  time  between  failures  (MTBFs)  can  be  estimated 
using  both  the  modified  existing  parts  lists  and  the  thermal  data  analys 
of  the  CSFDR  system  (see  3.2.8).  Many  of  the  other  parameters  which  are 
inputs  to  the  TI-59  model  can  also  be  estimated  with  reasonable  accuracy 
because  of  the  rather  detailed  design  definition  that  existed  during 
this  study  phase  of  the  program.  Many  of  the  support  input  parameters 
can  be  adequately  estimated  based  on  the  similarity  of  the  maintenance 
concept  (see  3.2.8)  and  the  related  support  equipment,  operation  and 
maintenance  manuals,  etc.,  to  the  other  programs  which  have  similarity 
in  circuit  design. 

b.  Deployment  scenario/usage  assumptions.  The  following 
deployment  and  usage  assumptions  were  used  in  the  LCC  analysis  for  each 
configuration. 


3,150  aircraft  installs:  730  A-lOs,  1030  F-15s, 
1390  F- 16s . 
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•  25  operating  hours  per  month  usage  per  aircraft. 

•  Peak  operating  hours  per  month  equals  one-tenth  of 
annual  operating  hours. 

•  68  total  base  maintenance  shops  for  A-lOs,  F-15s, 
and  F-16s. 

•  20-year  projected  inventory  usage  period. 

c.  Input  parameter  data.  The  definition  of  the  TI-59  LCC 
input  parameters  is  given  in  appendix  0.  The  parameter  values  used  for 
the  CSFDR  system  configurations  are  included  in  appendix  H.  Each  input 
sheet  represents  a  particular  CSFDR  system  configuration;  each  column  on 

a  sheet  specifies  the  input  for  an  LCC  run  for  an  individual  line-replaceable 
unit  (LRU)  or  shop-replaceable  unit  (SRU) . 

The  source  for  data  inputs  are  as  follows: 

•  System  development  and  investment  costs  are  through- 
putted  by  the  LCC  model.  The  estimation  of  these 
values  is  discussed  below. 

•  "Program  data"  inputs  are  derived  from  the  deploy¬ 
ment  scenario/usage  assumptions  discussed  above. 

•  "Item  Data"  inputs  are  derived  from  the  Production 
Unit  Cost  curve  determinations  and  the  reliability 
and  maintainability  discussions  in  3.2.8. 

•  The  "standard  parameter  values"  used  for  each  LCC 
run  for  each  CSFDR  system  configuration  are  listed 
in  appendix  G,  which  has  been  revised  to  reflect 

FY  '80  standard  parameter  values  as  provided  to  LSI 
on  another  USAF  program  in  November  of  1980. 

d.  LCC  model  outputs.  LCC  estimates  were  calculated  by 
accumulating  costs  from  the  individual  TI-59  LCC  model  runs  and  aggre¬ 
gating  them  under  appropriate  cost  categories.  LCC  elements  identified 
in  the  "Life  Cycle  Cost  Analysis  Worksheet",  of  appendix  G  are  used  in 
this  cost  analysis  effort.  They  are  expanded  where  necessary  for  com¬ 
pleteness.  Summaries  of  the  LCC  estimates  for  various  CSFDR  system 
configurations  are  provided  in  the  following  paragraphs  (3.4.1,  3.4.2, 
and  3.4.3).  A  description  of  the  costs  accumulated  under  each  cost 
element  or  category  is  given  in  the  following  paragraphs. 


Development  cost  includes  the  cost  estimates  for  an  Advanced  Devel¬ 
opment  phase  and  a  Full-Scale  Development  phase. 

Advanced  development  (ADV)  phase  costs  are  based  on  the  assumption 
that  one  breadboard  system  will  be  designed,  built,  integrated  and 
debugged,  and  that  the  CSMU  will  be  tested  on  a  limited  basis  for  crash- 
survivability. 

Full  Scale  Development  (FSD)  phase  costs  include  the  design  and 
build  of  six  prototypes;  reliability  and  qualification  testing;  the 
installation  of  prototypes  on  A-10,  F-15,  and  F-]6  aircraft;  flight  test 
support;  documentation;  and  blue  line  installation  drawings  for  each 
aircraft  configuration.  FSD  costs  exclude  logistics  development  costs. 
These  costs  will  be  included  in  the  Support  Investment  Costs. 

Investment  Costs  include  the  estimates  for  System  Investment  Cost 
and  Support  Investment  Cost: 

System  Investment  cost  is  the  acquisition  cost  of  3150  CSFDR  systems. 
The  ccst  is  determined  from  production  unit  cost  curves  which  take  into 
account  learning  curves  for  labor  in  the  assembly  and  test  of  the  CSFDR 
system,  and  the  sensitivity  of  material  cost  to  purchasing  volume.  The 
unit  cost  curves  reflect  a  92.5  percent  learning  or  cost  reduction  rate. 
This  rate  is  consistent  with  LSI's  experience  in  labor  learning  curves 
and  material  cost  reduction  curves. 

Support  Investment  costs  include  estimates  for  base  and  depot 
support  equipment,  manuals,  and  training;  installation  of  3150  CSFDR 
systems  (730  on  A-10  aircraft,  1030  on  F-15  aircraft,  and  1390  on  F-16 
aircraft);  initial  CSFDR  system  base  and  depot  spare  LRUs  and  SRUs;  the 
initial  lay-in  of  consumable  pieceparts  at  the  DPU,  CSMU,  and  MSU 
depot(s);  and  initial  spares  for  the  support  equipment  at  the  base  and 
depot  repair  facilities. 

•  Base  and  depot  spare  LRUs  and  SRUs  are  derived  by 
cost  equations  in  the  TI-59  LCC  model.  Other  support 
investment  cost  estimates  are  derived  separately 

from  the  model  using  past  experience  on  other  programs 
and  cost  estimating  relationships  (CERs). 

•  Support  equipment  costs  for  maintenance  support 
equipment  (refer  to  3.2.8  for  equipment  definition) 
and  read-out  support  equipment  (refer  to  3.2.6  for 
equipment  definition)  have  been  derived  by  relating 
to  similar  existing  or  proposed  support  equipment. 

The  maintenance  support  equipment  costs  include  a 
DPU  tester  at  each  of  68  base  shops,  a  DPU  tester 
and  board  extenders  at  the  DPU  depot,  an  automatic 
digital  and  an  automatic  analog  tester  with  appro- 
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priate  interface  test  adapters  (ITAs)  for  testing 
DPU  cards  at  the  DPU  depot,  and  special  test  equip¬ 
ment  for  testing  and  troubleshooting  CSMUs  and/or 
MSUs  at  the  depot(s).  The  read-out  support  equip¬ 
ment  cost  includes  a  data  retrieval  unit  at  each  of 
68  bases,  a  MSU  data  retrival  unit  at  each  of  the  68 
bases,  and  a  data  processor  retrieval  unit  at  the 
depot . 

Manual  costs  include  estimates  for  an  intermediate 
maintenance  manual  and  illustrated  parts  breakdown 
for  the  DPU,  overhaul  manuals  with  illustrated  parts 
lists  for  the  CSMU  and  for  the  MSU,  and  operation 
and  maintenance  manuals  with  illustrated  parts  lists 
for  the  support  equipment. 

Training  costs  reflect  the  cost  for  maintenance 
training  classes  to  instruct  flight  line  and  shop 
personnel  on  the  test  and  fault  isolation  of  the 
CSFDR  system  LRUs  and  SRUs ,  using  appropriate  support 
equipment,  and  for  training  on  the  maintenance  of 
the  support  equipment. 

Provisioning  data  costs  cover  the  documentation  of 
recommended  quantities  of  spares  for  the  CSFDR 
systems . 

Installation  costs  were  calculated  for  individual 
aircraft  types  (A-i"  F-15,  and  F-16).  The  kit  cost 

and  installation  time  varies  for  the  various  air¬ 
craft  types  and  for  the  various  CSFDR  system  config¬ 
urations.  Assuming  the  installations  would  be 
performed  at  Programmed  Depot  Maintenance  (PDM),  the 
following  estimates  were  used: 


Conf ig. 

Acft. 

Kit  Cost/Acit. 

Install  Time/Acft 

I 

A- 10 

$6290 

220 

F-15 

$5586 

190 

F-16 

$5342 

210 

II 

A-  10 

$6035 

200 

F-15 

$5332 

170 

F-16 

$5088 

195 

III 

A-  10 

$8439 

240 

F-15 

$7735 

205 

F-16 

$7313 

230 
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Operation  and  support  costs  were  derived  by  cost  equations  in  the 
TI-59  LCC  model.  Parameter  inputs  to  these  equations  are  indicated  in 
the  input  worksheets  in  appendix  H.  Costs  for  data  read-out  from  the 
MSUs  in  Configuration  III  were  calculated  using  the  assumption  that  data 
will  he  read-out  semi-monthly.  Data  reduction  costs  for  this  data  have 
not  been  included.  Since  the  frequency  of  data  readout  from  the  CSMU  is 
dependent  upon  mishap  frequency,  the  associated  cost  has  not  been  calculated. 
A  scheduled  maintenance  cost  for  the  EE-PROM  memory  in  the  CSMU  need  not 
be  included  since  the  number  of  write  cycles  during  a  20-year  usage 
period  for  a  given  CSMU  is  significantly  smaller  than  the  projected 
number  of  cycles  at  which  replacement  is  required. 

The  support  equipment  maintenance  cost  is  not  calculated  by  the 
TI-59  LCC  model.  Therefore,  it  was  throughputted .  It  was  determined  by 
using  a  percentage  of  the  support  equipment  acquisition  cost.  The 
percentage  used  was  20  percent.  This  value  is  considered  as  conserva¬ 
tively  high,  based  on  LSI's  previous  experience  and  anticipated  support 
equipment  loading  factors. 

3.4.1  Alternate  Configuration  I  -  This  configuration  is  designed 

to  record  the  maximum  number  of  flight  parameters  for  the  longest  practical 
time  before  recycling.  The  following  summary  accumulates  costs  for 
development,  CSFDR  system  investment,  support  investment,  and  logistics 
and  maintenance  support  for  20  years. 

Development  Cost  $  2,382,800 

Investment  84,010,900 

Total  Operation  and  Support  (20  years)  3,632 ,700 

Total  LCC  (3,150  CSFDR  systems)  $90,026,400 

LCC  per  CSFDR  System  $  28,580 

3.4.2  Operational  Configuration  II  -  This  configuration  is  designed 
to  record  only  the  highest  priority  flight  data.  This  configuration  is 
optimized  for  the  lowest  practical  development,  investment,  operation 
and  logistics  support  costs.  These  costs  are  derived  for  the  ground 
support  equipment  (maintenance  and  read-out  equipment)  as  well  as  for 
the  flight  hardware.  These  costs  are  summarized  below. 


Development  Cost 
Investment 

Total  Operation  and  Support  (20  years) 
Total  LCC  (3,150  CSFDR  systems) 

LCC  per  CSFDR  system 


$  2,159,600 
72,349,400 
3,413,400 
$77,922,400 
$  24,740 


3.4.3  Optional  Configuration  ill  -  This  configuration  is  similar 
to  Configuration  I,  except  added  capability  to  provide  non-crash-survivable 
memory  has  been  included.  The  cost  summary  below  accumulates  the  total 
development,  investment,  and  20-year  support  costs  both  for  the  CSFDR 
system  with  the  additional  memory  capability  provided  by  the  MSU  and  for 
the  jssociated  ground  support  equipment.  The  ground  support  equipment 
includes  read-out  and  maintenance  equipment  foy‘  the  additional  memory. 

The  first  set  of  costs  is  based  on  the  assumption  that  four-fifths  of 
each  type  of  aircraft  will  have  Configuration  I  installed,  and  one-fifth 
will  have  Configuration  III  installed. 


Development  Cost 
Investment 

Total  Operation  and  Support  (20  years) 
Total  LCC  (3,150  CSFDR  systems) 

Average  LCC  per  system 


$  2,899,200 

98,572,600 
6,558,700 
$108,030,500 
$  34,300 


If  it  is  assumed  that  all  3,150  aircraft  have  Configuration  III 
installed,  the  following  cost  summary  is  derived: 


Development  Cose 
Investment 

Total  Operation  and  Support  (20  years) 
Total  LCC  (3,150  CSFDR  systems) 

LCC  per  system  (CSFDR  system  +  MSU) 


$  2,899,200 

127,745,700 
16,793,100 
$147,438,000 
$  46,800 
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3.5  Cost/benefit  analysis  summary 

The  cost/benefit  analysis  is  the  portion  of  the  study  effort  which 
determines  the  true  value  of  the  overall  CSFDR  system.  Although  many  of 
the  benefits  to  be  derived  from  the  use  of  the  CSFDR  system  are  tangible 
and  have  dollar  values  directly  associated  with  them,  there  are  also 
some  very  important  intangible  values  which  must  be  included  in  a  thor¬ 
ough  cost/benefit  analysis,  especially  where  safety  is  involved. 

The  cost/benefit  analysis  is  extremely  important  for  two  reasons: 

a.  It  provides  the  basis  for  the  recommendation  to  continue 
or  to  stop  work  in  the  CSFDR  system  area. 

b.  Since  the  recommendation  is  to  continue,  the  analysis  can 
become  a  valuable  document  used  to  eliminate  waiver  requests  (or  the 
equivalent  thereof)  which  have  historically  been  used  to  prevent  the 
incorporation  of  CSFDR  systems  into  A/F/T  aircraft. 

3.5.1  Analysis  of  tangible  benefits  -  The  purpose  of  this  section 
is  to  determine  the  tangible  dollar  savings  that  would  be  achieved  by 
incorporating  the  CSFDR  system  into  A/F/T  aircraft.  The  A-10,  F-15,  and 
F-16  aircraft  are  used  as  examples  for  the  model  developed.  However, 
since  these  aircraft  are  already  in  production  and  have  already  experi¬ 
enced  some  accidents,  the  full  benefits  to  be  derived  from  CSFDR  systems 
will  not  be  experienced  by  these  programs.  The  results  are  adjusted 
accordingly  to  reflect  the  fact  that  these  programs  are  already  down¬ 
stream  in  their  life  cycles;  however,  the  conclusions  of  the  analysis 
are  unaffected. 

3.5. 1.1  Calculation  of  Class-A  aircraft  mishaps  -  The  following 
method  was  used  to  calculate  the  expected  aircraft  mishaps  for  the  A-10, 
F-15,  and  F-16  during  their  life  cycle.  The  answer  was  then  run  by 
safety  personnel  and  found  to  correspond  very  well  to  experienced  results 
for  A/F/T  aircraft. 

The  actual  calculations  of  aircraft  losses  is  complicated  by  the 
fact  that  the  fleet  size  is  progressively  reduced  following  each  acci¬ 
dent  and  therefore,  the  total  flight  hours  for  a  given  aircraft  is  a 
variable.  Additionally,  most  aircraft  do  not  realize  their  total  design 
life  before  they  are  "moth-balled"  or  cannibalized  for  spare  parts. 
Therefore,  the  total  design  life  of  8,000  hours  for  the  aforementioned 
aircraft  cannot  be  assumed  for  the  surviving  aircraft  which  are  retired. 


332 


The  method  for  calculating  aircraft  losses  is  based  upon  proba¬ 
bilistic  considerations.  The  probability  of  a  given  aircraft  to  survive 
its'  life  cycle  without  a  Class-A  mishap  is  given  by 


where 

Pg  =  probability  that  a  given  aircraft  will 

survive  its  life  cycle  without  experi¬ 
encing  a  Class-A  mishap 

A  =  Class-A  accident  rate  for  the  aircraft 
type  (A- 1 0 ,  F-15,  etc.) 

T  =  average  accumulative  flight  hours  on 

surviving  aircraft. 

The  probability  that  a  given  aircraft  will  experience  a  Class-A  mishap 
is  given  by 


1  -  e 


where 

=  probability  that  a  given  aircraft  will 
experience  a  Class-A  mishap. 

If  n  is  the  total  number  of  Class-A  mishaps,  they  are  distributed  according 
to  the  following  equation  (assuming  a  binomial  distribution): 


fn\  _AT. 

(  ■  )  O  -  e  )  e 


where 


total  number  of  Class-A  mishaps 
total  number  of  aircraft  type  produced. 


The  number  of  Class-A  mishaps  is  then 


i .  -AT. 
n(l  -  e  ) 


Table  45  shows  the  data  used  to  compute  the  specific  number  of 
aircraft  Class-A  mishaps  for  the  A-10,  F-15,  and  F-16,  respectively. 
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Table  45.  Aircraft  Specific  Data 


AIRCRAFT 

TYPE 

CLASS  A 
ACCIDENT 

RATE 

(M 

AVERAGE  FLT. 
HRS.  PER 
iONTH  PER  A/C 

AVERAGE 
ACCUMULA  i'IVE 

FLT.  HOURS  ON 
SURVIVING  AIRCRAFT 
(T) 

AIRCRAFT 

PRODUCED 

(n) 

AVERAGE 
$  PER 
CLASS  A 
MISHAP 

A-10 

5.81  x  10"5 

30 

7,200 

730 

5.5  M 

F-15 

6.00  x  10"5 

25 

6,000 

1,030 

11.7  M 

F-16 

7.00  x  10"5 

25 

6,000 

1,390 

12.63  M 

Using  the  preceding  equation  for  n,  the  following  Class-A  mishap 
totals  are  computed. 

A-10  Class-A  mishaps  in  life  cycle  =  250 

F-15  Class-A  mishaps  in  life  cycle  =  311 

F-16  Class-A  mishaps  in  life  cycle  =  476 

However,  because  these  aircraft  programs  are  already  within  their 
life  cycles,  the  Class-A  mishaps  to  date  must  be  subtracted  from  the 
totals.  Thus,  we  have 

A-10  Class-A  mishaps  remaining  in 
life  cycle  =  250  -  19  =  231 

F-15  Class-A  mishaps  remaining  in 
life  cycle  =  311  -  25  =  286 

F-16  Class-A  mishaps  remaining  in 
life  cycle  =  476  -  7  =  469 

3.5. 1.2  Minor  mishaps  -  Although  the  CSFDR  system  would  occasionally 
be  useful  in  regard  to  minor  mishaps,  a  benefit  for  class  B,  C,  and  D 
mishaps  will  not  be  included  in  the  cost/benefit  analysis.  This  is  in 
accordance  with  the  general  policy  of  keeping  the  analysis  conservative. 
Moreover,  the  benefit  provided  by  the  CSFDR  system  in  the  minor  mishap 
cases  is  relatively  small  when  compared  to  the  benefit  provided  by  the 
CSFDR  system  for  Class-A  mishaps. 

3.5. 1.3  Recovery  costs  -  Typical  recovery  costs  for  water-submerged 
and  non-submerged  aircraft  are  approximated  at  $500,000  per  Class-A 
mishap  and  $100,000  per  Class-A  mishap,  respectively. 
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3.5. 1.4  Recovery  ratios  -  Based  upon  the  study  of  221  A/F/T  Class-A 
mishaps  it  is  estimated  that  5%  of  these  mishaps  will  result  in  a  water-sub¬ 
merged  aircraft  and  that  95%  will  occur  over  land. 

3.5. 1.5  Calculation  for  expected  loss  of  life  -  Loss-of-life 
ratios  are  calculated  for  the  ccat/benef it  model  based  upon  actual  data. 
Table  2-1,  page  2-9  of  AFR127-4  lists  fatality  costs  as  $260,000  per 
rated  officer  and  $118,000  per  nonrated  officer.  Using  actual  data, 
then,  for  the  A-10,  we  have 

Fatality  cost 

per  A-10  = 

Class-A  mishap 

+ 


8  rated  officers  x  $260,000 
19  Class-A  mishaps 

1  nonrated  officer  x  $118,000 
19  Class-A  mishaps 

$115,684/Class-A  mishap 


Similarly  for  the  F-15  and  F-16  we  have 


Fatality  cost 
per  F-15 
Class-A  mishap 


7 ($260,000)  +  lx  $118,000 
25  Class-A  mishaps 

$77 ,520/Class-A  mishap 


Fatality  cost 

per  F-16  =  0 

Class-A  mishap 


Note  that  the  loss-of-life  calculations  are  conservative  in  that 
they  do  not  include  hospitalization  if  loss  of  life  is  not  immediate  and 
they  do  not  include  survivor's  insurance.  Moreover,  the  F-16  loss-of-life 
is  assumed  to  continue  at  its  current  rate  of  0. 

3.5. 1.6  Probable  cause  ratios  -  Based  upon  NAFB  experience,  since 
1976,  for  A/F/T  Class-A  mishaps,  the  cause  ratios  are 


1. 

Operations,  design  induced 

34.3% 

2. 

Operations,  misjudgement 

17.2% 

3. 

Logistics  (part  and  failure 

mode  known) 

13.1% 

4. 

Logistics  (part  only,  failure 

mode  unknown) 

26.2% 

5. 

Undetermined 

9.2% 
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3.5. 1.7  Tangible  cost/benefit  calculations  -  The  cost/benefit 
formula  for  tangible  savings  due  to  a  CSFDR  system  is 


Tangible 
dollar  value 
of  benefits 


+ 


minor  jjiirfchaps 
cos^/iavings 


total  over-water  accident 
cost  savings 


total  over-land  accident 
cost  savings 


Using  the  data  previously  computed  and/or  determined  from  the 
actual  mishap  listing  survey,  the  tangible  dollar  value  of  benefits  for 
the  CSFDR  system  as  applied  to  the  A-10,  F-15,  and  F-16  aircraft  becomes 


Tangible 
dollar  value 
of  benefits 


r 

■— 

•< 

11  A-10  mishaps 

$5,500,000  + 

$115,684 

+ 

$500,000 

over  water 

aircraft 

loss  of 

recovery 

damage 

life 

cost 

+ 

220  A-10  mishaps  • 

$5,500,000  + 

$115,684 

+ 

$100,000 

over  land 

aircraft 

loss  of 

recovery 

damage 

life 

cost 

+ 

14  F- .5  mishaps 

$11,700,000 

+  $77,520 

+ 

$500,000 

over  water 

aircraft 

loss  of 

recovery 

damage 

life 

cost 

-J 

+ 

272  F-15  mishaps  • 

$11 ,700,000 

+  $77,520 

+ 

$100,000 

ever  land 

aircraft 

loss  of 

recovery 

damage 

life 

cost 

*• 

+ 

23  F-16  mishaps  * 

$12,630,000 

+  0  + 

$500,000 

over  water 

aircraft 

loss  of 

recovery 

damage 

life 

cost 

+  446  F-16  mishaps 
over  land 


$12,630,000  +  0  + 
aircraft  loss 

damage  life 


of 


$100,000 
recove ry 
cost 


{10.7  x  109}E 


where  E  is  the  effectiveness  of  the  CSFDR  system  in  preventing  Class-A 
mishaps  taken  over  all  mishap  types.  Although  E  is  a  somewhat  subjec¬ 
tive  factor,  a  range  of  E  can  be  hypothesized  as  shown  in  table  46. 


Table  46.  Calculation  of  Composite 


[ 


Minimum 

EKpected 

Optimistic 


Note  that  the  analysis  must  account  for  corresponding  values  of  E  for 
Configurations  I  and  II.  Because  Configuration  I  records  more  param¬ 
eters  and  for  a  longer  time  period  than  Configuration  II,  the  effective¬ 
ness  of  Configuration  II  is  somewhat  lower  than  that  of  Configuration  I. 
Table  46  shows  corresponding  values  of  effectiveness  for  each  probable 
cause  type.  These  values, for  E  are  also  based  upon  the  definitions  of 
Configurations  I  and  II  as  defined  in  this  study. 

The  tangible  dollar  value  of  benefits  is  tabulated  in  table  47  for 
various  values  of  E. 


Table  47.  Tangible  Savings  Achieved  by 
Incorporating  CSFDR  System  into 
A-10,  F-15,  and  F-16  Aircraft 


TOTAL  TANGIBLE 

SAVINGS  ($) 

COMPOSITE 
OF  E 

VALUE 

(%) 

COMMENTS 

Conf.  I 

Conf.  II 

Conf.  I 

Conf . 

II 

0.931  x  109 

0.813  x  1C9 

8.7 

7.6 

Minimum  benefits 

1.86  x 

1 .63  x 

r  .4 

15.2 

Expected  benefits 

2.79  x 

2.43  x 

26.1 

22.7 

3.74  x 

3.24  x 

34.9 

30.3 

Optimistic  benefits 

4.67  x 

4.06  x 

43.6 

37.9 

5.60  x 

4.87  x 

52.3 

45.5 

6.53  x 

5.67  x 

61.0 

53.0 

7.47  x 

6.49  x 

69.8 

60.6 

8.40  x 

7.30  x 

78.5 

68.2 

9.33  x 

8.  10  x 

87.2 

75.7 

10.26  x 

8.91  x 

95.9 

83.3 

_ 
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3. 5. 1.8  Tangible  cost/benefit  results  -  The  results  of  the  cost/ 
benefit  moael  show  a  dramatic  savings  of  tangible  dollars.  With  7.6% 
and  87%  recovery  rates  (composite  E)  a  savings  of  approximately 
$813,000,000  and  $931,000,000  will  be  realized  by  Configurations  II  and 
I,  respectively,  for  the  life  cycle  of  the  aircraft  under  consideration. 
At  expected  recovery  rates  of  15.2%  and  17.4%,  respectively,  savings  of 
approximately  $1,630,000,000  and  $1,860,000,000  could  be  realized. 

At  the  optimistic  recovery  rates,  savings  of  approximately 
$3,240,000,000  and  $3,740,000,000  could  be  realized. 

Using  the  expected  recovery  rates,  the  benefit/cost  ratios  for 
Configurations  I  and  II  become 


RATIOj 


1,860,000,000  -  3,632,700 
86,393,700 


=  21.5 


RATIOjj 


1,630,000,000  -  3,413,400 
74,509,000 


=  21.8 


where  3,632,700  and  3,413,400  are  the  negative  logistic  cost  savings  and 
86,393,700  and  74,509,000  are  the  initial  logistics  costs. 

Note  that  the  Configurations  I  and  II  provide  a  better  than  20/1 
payback. 


The  cost/benefit  analysis  for  Configuration  III  is  performed  by 
assuming  the  same  tangible  dollars  saved,  as  a  result  of  reduced  mis¬ 
haps,  as  was  the  case  for  Configuration  I,  and  by  analyzing  the  expanded 
recording  functions  incrementally.  The  analysis  is  simplified  by  assuming 
that  the  same  expanded  recording  functions  will  be  accomplished  with 
Configuration  III  as  are  currently  accomplished  with  ASIP  recorders. 

The  savings  in  life  cycle  costs  of  not  having  to  procure  and  support  the 
existing  type  of  electromechanical  recorders  now  used  for  ASIP  recording 


functions  appears  as  a  benefit  in  the  benefit/cost  ratio.  Therefore, 
for  Configuration  III 


RATIO, 


1,860,000,000  -  6,558,700  +  13,745,300 
101,471,800  -  13,071,900 


=  21.1 


where  13,071,900  is  the  benefit  derived  by  not  procuring  separate  recorders 
for  the  ASIP  recording  functions.  For  the  A-10,  F-15,  and  F-16  retrofit 
applications,  a  replacement  analysis  of  the  existing  recorders  provides 
a  slightly  lower  ratio  of  approximately 


RATIO, 


1,860,000,000  -  6,558,700  +  13,745,300  -  , 

101,471,800  "  ' 
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3.5.2  Discussion  of  intangible  benefits  -  Intangible  benefits 
derived  through  useage  of  the  CSFDR  system  are  those  which  are  known  to 
have  a  definite  value  that  cannot  reasonably  be  converted  to  actual 
dollars.  Intangible  benefits  projected  for  the  CSFDR  system  include  the 
following : 

•  Improved  strike  capability  due  to  a  reduction  in  fleet 
down  time  following  a  mishap  or  spate  of  mishaps. 

•  Improved  crew  morale  by  quick  determination  of  mishap 
cause  and  eliminating  a  spate  of  accidents  due  to  similar 
causes . 

•  Improved  data  concerning  airborne  "incidents",  which  do 
not  result  in  accidents,  but  provide  valuable  data  con¬ 
cerning  subsystem  performance  and  aircraft  performance. 

•  Elimination  of  the  element  of  doubt  in  determining  the 
true  cause  where  nonsurvivable-operations  type  mishaps 
occur . 

These  areas  are  discussed  in  more  detail  in  the  following  paragraphs 

3.5.2. 1  Reduction  in  fleet  down  time  ~  Historically  mishaps  and  a 
spate  of  mishaps  can  result  in  grounding  of  the  aircraft  fleet  un*il  the 
basic  cause  is  determined  and  the  deficiency  correct"4.  By  having  a 
CSFDR  system  on  board,  the  investigative  and  analys  une  will  be 
shortened.  Therefore,  the  CSFDR  system  will  not  only  reduce  the  inci¬ 
dence  of  similar  mishaps,  it  will  also  reduce  the  time  in  which  the 
fleet  is  grounded. 

The  dollar  value  associated  with  a  reduction  in  fleet  down  time  is 
variable  and  intangible.  Fleet  readiness  is  of  the  utmost  importance  in 
times  of  national  emergency  and  it  is  not  possible  to  predict  when  and 
how  frequently  national  emergencies  will  occur. 

Loss  of  training  time  and  reduction  in  morale  (discussed  in  the 
next  section)  also  occur  during  prolonged  periods  of  fleet  grounding. 

Loss  of  confidence  in  the  aircraft  itself  can  often  result.  The  dollar 
value  associated  with  these  losses  simply  cannot  be  measured. 

3. 5. 2. 2  Improved  crew  morale  -  Quick  and  accurate  determination  of 
the  mishap  cause  eliminates  the  possibility  of  a  spate  of  mishaps  due  to 
identical  or  similar  causes.  There  are  several  such  cases  in  military 
aviation  history,  where  an  outburst  of  mishaps  due  to  identical  causes 
has  occured.  In  one  case  42  mishaps  occured  before  the  real  cause  was 
identified.  In  another  case  10  mishaps  occured  within  a  span  of  one 
month.  During  such  short  periods  of  high  accident  rates,  crew  confi¬ 
dence  and  morale  deteriorates  significantly.  The  deterioration  of 
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confidence  and  morale  has  an  immeasureable  effect  on  crew  performance 
and  can  probably  be  linked  to  crew  turnover  rate.  It  cannot  be  measured 
in  real  dollars,  however.  The  important  poin* ,  is  that  an  onboard  CSFDR 
system  will  eliminate  the  possibility  of  a  spate  of  mishaps  due  to 
similar  causes  and,  therefore,  improve  crew  morale. 

3. 5. 2. 3  Improved  incident  data  -  There  are  many  non-catastrophic 
airborne  incidents  which  either  (1)  fail  to  get  reported  or  (2)  are  re¬ 
ported  inaccurately  due  to  heavy  pilot  workload  or  other  reasons.  Such 
incidents  may  occur  near  the  operating  envelope  of  the  aircraft  and  it 
becomes  difficult  to  determine  if  the  actual  cause  was  due  to  exceeding 
operational  limits,  subsys  em  failure,  or  incorrect  limit  specifications 

Data  concerning  such  incidents  are  valuable* 


3 . 5 . 2 . 4  More  accurate  determination  of  true  cause  for  non-survivable 
operations  mishaps  -  Mishap  data  for  A/F/T  aircraft  is  accumulated  through 
analysis  of  wreckage,  eyewitness  accounts,  site  scars,  and  any  other  avail 
able  source.  Mishap  Investigation  Boards  (MIBs)  use  the  "preponderance  of 
evidence"  method  is  assessing  cause  factors  where  there  are  no  survivors. 
Operator  error  findings  may  result  from  the  weight  of  evidence  in  the  ab¬ 
sence  of  contradictory  information.  The  CSFDR  system  will  significantly 
change  the  "preponderance  of  evidence"  method  and  permit  a  more  accurate 
determination  of  true  cause  fcr  the  non-survivable-operations  related 
mishaps . 

3.5.3  Discussion  of  benet it-to-cost  ratios  -  On  the  surface,  the 
calculated  benefit-to-cost  ratios  appear  to  be  unusually  high.  Typically, 
a  benefit-to-cost  ratio  of  3:1  or  4:1  would  totally  justify  a  go-ahead 
decision  for  the  type  of  program  being  considered.  The  calculated  ratios 
for  the  CSFDR  system  program  „re  in  the  range  of  20:1.  However,  this  un¬ 
usually  high  ratio  is  totally  justified,  and  is  realistic  for  the  program 
considered  for  the  following  reasons: 

a.  The  A- 10,  F-15,  and  F- 16  represent  an  expensive  f  of 
aircraft.  If  a  similar  cost/benefit  analysis  were  conducted  for  ■*  A-7, 
F-4,  and  F-5,  the  banefit-to-cost  ratio  would  be  reduced  by  apprr  *mately 
a  factor  of  3. 

b.  Standardizing  the  CSFDR  system  for  a  group  of  aircraft, 
such  as  the  A-10,  F-15,  and  F-16,  reduces  the  life  cycle  cost  per  air¬ 
craft.  This  reduction  is  then  reflected  in  an  increase  in  the  benefit- 
to-cost  ratio. 

c.  The  accident  rates  for  the  three  aircraft  considered  are 
slightly  higher  than  historic  fleet  averages  for  A/F/T  aircraft.  However, 
the  accident  rates  assumed  are  felt  to  be  realistic. 
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4.  CONCLUSIONS 


The  primary  conclusions  derived  from  the  CSFDR  system  study  are  as 
follows : 


a.  The  current  state  of  the  art  in  electronics  technology 
permits  Configuration  II,  with  a  minimum  level  of  input  parameters 
(typically  35),  and  an  average  real-time  storage  of  19  minutes,  to  be 
designed  and  produced  at  a  size  and  weight  applicable  to  A/F/T  aircraft. 

The  size  and  weight  are  significantly  less  than  contemporary  electro¬ 
mechanical  recorders. 

b.  Also,  Configuration  I,  with  a  higher  level  of  input  parameters 
(typically  56),  and  an  average  real-time  storage  of  29  minutes,  can  be 
designed  and  produced  at  a  size  and  weight  applicable  to  A/F/T  aircraft. 

The  size  and  weight  of  this  configuration  are  also  significantly  less 

than  contemporary  electromechanical  recorders.  Moreover,  the  addition 
of  solid-state  mass  storage  units  permits  this  configuration  to  be  used 
for  expanded  airborne  recording  functions.  The  resulting  recorder 
system,  Configuration  III,  is  a  single  standardized  family  of  modules 
which  can  be  used  for  any  set  of  airborne  recording  functions. 

c.  High  performance  aircraft,  such  as  A/F/Ts,  have  complex 
flight  control  systems  and  aerodynamic  behavior.  Consequently,  the  use 
of  a  very  small  parameter  list  (such  as  8-10  parameters)  will  not  pro¬ 
vide  sufficient  accident  investigation  capability  for  these  aircraft. 

d.  Separation  of  the  survivable  memory  pack  from  the  con¬ 
version/  processing  functions  enhances  survivability,  reduces  the  total 
weight  of  the  installation,  and  increases  the  number  of  potential  instal¬ 
lation  locations  for  the  survivable  function. 

e.  Use  of  multiple,  non-hardened  memories  located  in  the 
aircraft  extremities  will  not  provide  the  required  survivability  ratios 
for  A/F/T  applications.  However,  the  extremities  of  A/F/T  aircraft, 
such  as  the  wing  tips  and  tail  sections,  exhibit  the  best  mechanical  and 
thermal  survivability  characteristics  and  these  areas  are  recommended 
for  the  hardened  module. 

f.  The  TS0-C51A  was  not  conceived  with  A/F/T  applications  in 
mind.  Therefore,  it  is  recommended  that  the  A/F/T  crash-survivability 
specification  developed  in  this  study  be  used  instead  of  TS0-C51A. 
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g.  A  tri-service  standard  crash-survivable  flight  data  recor¬ 
der  is  feasible  if  two  parameters  are  not  included  in  the  design: 

•  audio 

•  recording  through  impact 

The  ejectability  requirement  (and  floatation)  is  required  for  Navy 
applications  and  is  compatible  with  the  two-box  approach  recommended. 

h.  Application  to  future  A/F/T  aircraft  will  be  simplified 
because  the  standard  CSFDR  system  can  be  planned  into  the  design  from 
the  beginning,  thereby  eliminating  some  of  the  costs  and  technical 
problems  which  are  directly  related  to  the  retrofit  operation.  The 
standard  CSFDR  software  can  be  reprogrammed  for  this  application. 
Configuration  III  is  the  recommended  configuration  for  future  A/F/T 
aircraft . 


i.  Large-scale  standardization  to  cargo/passenger/bomber  air¬ 
craft  is  feasible,  but  requires  a  modified  survivable  memory  due  to  the 
longer  time  history  of  parameters  and  the  different  crash-survivability 
test  required.  All  other  units  of  the  standard  CSFDR  system  are  directly 
applicable  to  these  aircraft. 

j.  Expanded  recording  functions,  such  as  ASIP,  TEH,  and  FC 
system  monitoring  have  only  a  minimal  effect  on  the  conversion  and  pro¬ 
cessing  functions  of  Configuration  I.  These  expanded  recording  func¬ 
tions  are  easily  achieved  by  adding  mass  storage  units  to  the  basic 
system. 


k.  Encryption  techniques,  which  result  in  only  one-half  of  a 
board  of  processor  "real  estate",  can  be  used  to  provide  all  the  security 
protection  features  requried  for  operation  at  or  near  enemy  territory. 

l.  A  readout  station  having  a  four-level  readout  capability 
can  easily  be  provided  to  Norton  Air  Force  Base  for  mishap  investigations. 
This  station  would  utilize  a  solid-state  data  processor  retrieval  unit 
made  directly  compatible  with  the  existing  Norton  AFB  EDP  facility.  Al¬ 
ternate  readout  facilities  are  also  possible  at  minimum  risk  to  the  USAF. 

in.  The  memory  technologies  most  suitable  for  incorporation  into 
the  Crash-Survivable  Memory  Unit  (CSMU)  are  the  EE-PROM  and  MNOS  types. 

n.  A  data  compression  technique  which  uses  floating  apertures 
and  a  zero-order  polynomial  predictor,  which  is  adaptive  to  flight  con¬ 
ditions,  can  be  used  to  reduce  the  crash-survivable  memory  required. 

This,  in  turn,  reduces  the  overall  cost  of  the  CSFDR  system. 
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o.  The  reprogrammability  feature  of  the  Data  Processor  Unit 
permits  a  common  design  to  be  used  for  various  aircraft.  The  A-10, 

F-15,  and  F-16  were  studied  for  specific  applications.  Enough  common¬ 
ality  exists  such  that  a  single  CSFDR  system  concept  can  be  implemented 
for  these  aircraft.  In  addition,  the  standard  CSFDR  system  can  be 
reprogrammed  for  many  other  applications. 

p.  The  estimated  size  and  weight  of  Configuration  II  are  232 
cubic  inches  and  10  pounds.  For  Configuration  I,  a  size  of  254  cubic 
inches  and  weight  of  11.2  pounds  are  projected.  For  Configuration  III, 
a  size  of  362  cubic  inches  and  weight  of  17.2  pounds  are  projected. 

q.  For  a  three-aircraft  program  (A-10,  F-15,  and  F-16),  LCCs 
$28,580,  $24,740,  and  $34,300  are  computed  on  a  per  aircraft  basis 

for  Configurations  I,  II,  and  III.  These  calculations  include  the  mass 
storage  unit  required  for  Configuration  III  and  assume  that  one-fifth  of 
the  aircraft  have  the  mass  storage  units  installed.  If  all  of  the 
aircraft  have  the  mass  storage  units  installed,  the  LCC  per  aircraft  is 
computed  as  $46,800. 

r.  All  configurations  studied  have  positive  cost/benefit 
ratios  for  the  three-aircraft  program. 
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5.  RECOMMENDATIONS 


Based  upon  the  results  of  the  USAF  CSFDR  system  study  contract,  the 
following  recommendations  are  made: 

a.  Work  on  the  standard  CSFDR  system  should  continue. 

(1)  A  follow-on  program  should  be  established  for  a 
prototype  feasibility  flight  test  for  Configurations  IT  and  III. 

(2)  Prototype  CSMUs  which  meet  the  A/F/T  crash-survivability 
specification  as  outlined  herein  should  be  constructed  and  tested. 

b.  The  results  of  this  study  should  be  made  available  to 
cognizant  personnel  within  the  USAF  so  that  the  need  for  the  standard 
CSFDR  system  is  fully  realized  in  establishing  the  funding  for  the 
follow-on  phase. 

c.  For  the  retrofit  applications  such  as  A-10,  F-15,  and 
F- 1 6 ,  Configuration  IT  should  be  developed  and  produced. 

d.  For  future  aircraft,  Configuration  III  should  be  developed 
and  produced,  thereby  eliminating  the  proliferation  of  recorders  which 
perform  similar  functions. 
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APPENDIX  B 


ACS 

ADV 

AFISC 

AHMR 

AHRS, 

AIRS 

AOA 

APU 

ASIP 

ATE 

A/F/T 

BIT 

BORAM 

BUC 

CADC , 

CAS 

CAVT 

CC 

CCD 

CDP 

CER 

CIVV 

CMOS 

CPM 

CSFDR 

CSMU 

DDC 

DES 

DFDR 

DME 

DPRU 

DPU 

DP/DC 

DRU 

DTM 

DTS 

EAROM 

ECA 

ECL 

EDP 

EDS 

EEC 


Abbre  ’iations/Acronyms 

Armament  Coi trol  Set 
Advanced  Development 

Air  Force  Inspection  and  Safety  Center 
Aircraft  Health  Monitoring  Recorder 
HARS,  AHARS  Attitude  and  Heading  Reference  System 
Accident  Information  Retrieval  System 
Angle  Of  Attack 
Auxiliary  Power  Unit 
Aircraft  Structural  Integrity  Program 
Automatic  Test  Equipment 
Attack/Fighter/Trainer 
Built  In  Test 

Block  Oriented  Random  Access  Memory 
Back-Up  Control 

ADC  Central  Air  Data  Computer 

Control  Augmentation  System 

Cavi tation 

Central  Computer 

Charge-Couplf d  Devices 

Compressor  Discharge  Pressure 

Cost  Estimating  Relationship 

Compressor  Inlet  Variable  Vanes 

Complementary  Metal  Oxide  Semiconductor 

Crash  Protected  Memory 

Crash-Surv tvable  Flight  Data  Recording 

Crash  Survivable  Memory  Unit 

Direct  Data  Compressor 

Data  Encryption  Standard 

Digital  Flight  Data  Recorder 

Distance  Measuring  Equipment 

Data  Processor  Retrieval  Unit 

Data  Processing  Unit 

Data  Processing/Data  Compression 

Data  Retrieval  Unit 

Data  Transfer  Modules 

Data  Transfer  System 

Electrically  Alterable  Read  Only  Memory 
Electronic  Component  Assembly 
Emitter-Coupled  Logic 
Electronic  Data  Processing 
Engine  Diagnostic  System 
Electronic  Engine  Control 


EE -PROM 

EGT 

EHR 

EPR 

EPROM 

EPU 

ettr 

FC 
FCC 
FCS 
FDA 
FDAU 
FIR 
FIR/UL 
FLCC 
or  FCC 
FSD 
FT  IT 
GSE 
HSIS 
HUD 
I  AW 
I  CD 
IECMS 
I  MU 
INS 
INU 
ITA 
ITT 
I2L 
1 3L 
JFS 
LCC 
LCG 
LEF 
LRU 
MBC 
MDRM 
MDS 
MER 
MNOS 
MR 
MSU 
MTBF 
NBS 


Electrically  Erasable-Programmable  Read  only  Memory 
Exhaust  Gas  Temperature 


Engine  Health  Recorder 
Engine  Pressure  Ratio 

Electrically  Programmable  Read  Only  Memory 
Emergency  Power  Unit 


IX.)  1  - 

m  •  /  rr _ Iiva  P  orr>rHp  r 


Flight  Control 
Fire  Control  Computer 
Flight  Control  System 
Flight  Director  Adapter 
Flight  Data  Acquisition  Unit 
Flight  Incident  Recorder 

Flight  Incident  Recorder/Universal  Locator 


Flight  Control  Computer 
Full  Scale  Development 
Fan  Turbine  Inlet  Temperature 
Ground  Support  Equipment 
Horizontal  Situation  Indicator  Set 
Head  Up  Display 
In  Accordance  With 
Interface  Control  Document 

Integrated  Engine  Condition  Monitoring  ys  em 

Inertial  Measurement  Unit 

Inertial  Nav  System 

Inertial  Nav  Unit 

Interface  Test  Adapter 

Interstage  Turbine  Temperature 

Integrated  Injection  Logic 

Isoplanar  Integrated  Injection  Logic 

Jet  Fuel  Starter 

Life  Cycle  Cost 

Lead  Computing  Gyro 

Leading  Edge  Flap 

Line  Replaceable  Unit 

Master  Bus  Controller 

Maintenance  Data  Recorder  Magazine 

Microprocessor  Development  System 

Multiple  Ejector  RACK 

Metal  Nitride  Oxide  Semiconductor 

Master  Reset 

Mass  Storage  Units 

Mean  Time  Between  Failures 

National  Bureau  of  Standards 
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NMOS 

N-Channel  Metal  Oxide  Semiconductor 

NPS 

Naval  Postgraduate  School 

NPS-1 

Naval  Postgraduate  School  (List  1) 

NPS-2 

Naval  Postgraduate  School  (List  2) 

NT5B 

National  Transportation  Safety  Board 

OAT 

Outside  Air  Temperature 

OPS 

Operations  Per  Second 

PD  I 

Power-Down  Interrupt 

PDM 

Programmed  Depot  Maintenance 

PIU 

Playback  Interface  Unit 

PMOS 

P-Channel  MOS 

PROM 

Programmable  Read  Only  Memory 

PSI 

Pounds  per  Square  Inch 

PSIG 

Pounds  per  Square  Inch  Gauge 

RAM 

Random  Access  Memory 

RCVV 

Rear  Compressor  Variable  Vanes 

SAS 

Stability  Augmentation  System 

SMS 

Stores  Management  System 

SON 

Statement  of  Need 

SOS 

Silicon  On  Sapphire 

SRU 

Shop  Replaceable  Unit 

STP 

Self  Test  Program 

TEH 

Turbine  Engine  Health 

TEMS 

Turbine  Engine  Monitoring  System 

TTL 

Transistor  Transistor  Logic 

UART 

Universal  Asynchronous  Receiver  Transmitter 

UFC 

Unified  Fuel  Control 

UGTU 

Universal  Ground  Terminal  Unit 

ULAIDS 

Universal  Locator  Airborne  Integrated  Data  System 

VMOS 

V-Groove  MOS 

VTR 

Video  Tape  Recorder 
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APPENDIX  C 


Applicable  Documents  to  Installation  Investigation 


The  following  is  a  list  of  federal  and  military  specifications, 
military  standards,  and  technical  orders  that  are  adhered  to  during 
system  design,  fabrication  and  installation. 


SPECIFICATIONS 

Federal 

QQ-W-343 

QQ-S-571 

QQ-P-575 

Military 

MIL-C-17 

MIL-C-572 


DOD-D-IOOO 

MIL-C-5015 

MIL-W-5088 

MIL-E-6051 


MIL -E-7016 


MIL-T-7928 

M1L-S-8516 

MIL- I- 15126 
MIL-W-22759 


Wire,  Electrical  f uninsulated) 

Solder,  Tin  Alloy,  Lead-tin  Alloy,  and  Lead 
Alloy 

Braid,  Wire  (Copper,  Tin  Coated  Tubular) 


Cables,  Radio  Frequency,  Flexible  and  Semi-rigid 

Cords,  Yarns,  and  Monofilaments  -  Organic 
Synthetic  Fiber 

Drawings,  Engineering  and  Data 

Connectors,  Electrical,  Circular  Threaded,  AN 
Type,  General  Specification  for 

Wiring,  Aircraft,  Installation  of 

Electromagnetic  Compatibility  Requirements, 

Sys  Lems 

Electrical  Load  and  Power  Source  Capacity, 
Aircraft,  Analysis  of 

Terminal,  Lug  and  Splice,  Crimp  Sty1!?.  Copper 

Sealing  Compound,  Polysulfide  Rubber  Base, 
Electric  Connectors  and  Electric  Systems, 
Chemically  Cured 

Insulation  Tape,  Electrical  Pressure  Sensitive 

Wire,  Electric,  Fluoropolymer-insulated  Copper 
or  Copper  Alloy 


3C 


MIL-I-23053 

MIL-W-25038 

HIL-S-23586 

MIL-I-23594 

MI L-C-26482 

MIL-C-27500 

MI L-C-27599 

MII.-C-38999 

MI L-C-390 1 2 

MIL-T-43435 

MI  I.- 1-46852 
(SM2173) 

MIL-W-81381 

MI L— M— 81531 
MIL-S-81824 

MIL-C-83723/I 


Insulation,  Sleeving,  Electrical,  Heat  Shrinkable, 
General  Specification  for 

Wire,  Electrical,  High  Temperature  and  Fire 
Resistant,  Aircraft 

Silicone  Rubber  Compound,  Room  Temperature 
Vulcanizing 

Insulation  Tape,  Electrical  High  Temperature, 
Polytetraf luroethelene ,  Pressure  Sensitive 

Connector,  Electrical,  Bayonet  Coupling,  Crimp 
Type  Contact  Corrosion  Proof 

Cable,  Electrical  Shielded  and  Unshielded, 

Aerospace 

Connector,  Electrical,  Miniature,  Quick  Disconnect 
tfor  Weapons  Systems)  Established  Reliability 

Connectors,  General  Purpose,  Electrical,  Miniature, 
Circular,  Environment  Resisting 

Connectors,  Coaxial,  Radio  Frequency 

Tape,  Lacing  and  Tying 

insulation  Tape,  Electrical,  Self  Adhering, 
Unsupported,  Silicone  Rubber 

Wire,  Electric,  Polyimide  -  Insulated,  Copper 
or  Copper  Alloy 

Marking  of  Electrical  Insulating  Materials 

Splice,  Electric,  Permanent  Crimp  Style,  Copper, 
Insulated,  Environment  Resistant,  Class  I 

Connectors,  Electrical,  (Circular,  Environment 
Resisting)  Bayonet  Coupling,  Solder  Contact, 

Series  1 


352 


STAN'-'uvDS 


Military 


MiL-STD-1353 

Electrical  Connectors  and  Associated  Hardware, 
Selection  and  Use  of 

MIL-STD-129 

Marking  for  Shipment  and  Storage 

MIL-STD-202 

Test  Methods  for  Electronic  and  Electrical 
Component  Parts 

MIL-STD-454 

Standard  General  Requirements  for  Electronic 
Equipment 

MIL-STD-461 

Electromagnetic  Interference  Characteristics, 
Requirements  for  Equipment 

MIL-STD-794 

Parts  and  Equipment,  Procedures  for  Packaging 
and  Packing  of 

DOD-STD- 100 

Engineering  Drawing  Practices 

MIL-STD-704 

Electric  Power  Aircraft  Characteristics  and 
Utilization  of 

National  Aerospace 

Standard 

MAS 17 45 

Splice,  Conductor,  Hot  Air  Shrinkable,  Insulated 

NAS1746 

Splice,  Conductor,  Heat  Shrinkable,  Insulated 

Technical  Orders 

1-1A-14 

Installation  Practices,  Aircraft  Electric  and 
Electronic  Wiring 
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APPENDIX  D 


Review  of  Mishap  Data 


The  following  data  and  conclusions  were  assembled  after  reviewing 
A-10  and  F-16  Class-A  accident  reports  on  file  at  Norton  A.F.B.  In 
addition,  the  computer  printout  of  some  500  Class-A  and  -B,  Part  I 
accident  reports  were  reviewed. 

A-10/F-16  DAMAGE  FROM  CLASS-A  MISHAPS 

A  summary  of  the  aircraft  damage  which  has  resulted  from  A-10  and 
F-16,  Class-A  mishaps  is  shown  in  tables  D-l  and  D-2,  respectively.  The 
definitions  are  repeated  heie  for  the  reader's  convenience. 


Mechanica 1  Break-Up  Damage 

1.  Total  -  Many  small  pieces,  not  recognizable. 

2.  Major  -  Many  medium  sized  pieces,  some  recognizable. 

3.  Significant  -  Some  large  pieces,  many  recognizable. 

4.  Minor  -  Relatively  intact. 

Unknown  -  Wreckage  not  recovered. 

F i re  Damage 

1.  Total  -  Major  puddling. 

2.  Major  -  Burnthrough,  some  puddling. 

3.  Minor  -  Paint  burn,  sooting. 


4. 


None  -  No  post-crash  fire. 

Unknown  -  Wreckage  not  recovered. 
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Table  D-2.  F-16  Survivability  Data  From  Class-A  Mishaps  (5  accidents) 


356 


CONCLUSIONS  FROM  F-16  DATA 


1.  The  ejection  seat  is  an  excellent  location  for  a  semi-protected 
fly-away  memory  pack,  however,  use  of  this  location  for  the  CSFDR  system 
memory  module  violates  the  RFP  ground  rules  for  Configurations  I  and 


III. 


2.  The  vertical  tail  section  is  an  excellent  location  and  is  a 
recommended  location  for  the  CSMU. 

3.  The  tail  cone  and  wing  tips  are  also  excellent  locations  for 
the  CSMU  and  are  considered  as  good  alternatives  to  the  vertical  tail 
section. 

4.  The  canopy  rail,  cockpit,  and  avionics  bay  are  unacceptable 
locations  for  the  CSMU. 

5.  The  avionics  bay  is  acceptable  as  a  location  for  the  non- 
survivable  data  compression/data  processing  functions. 

CONCLUSIONS  FROM  A- 10  DATA 

1.  No  section  of  the  A-10  aircraft  is  immune  from  significant 
mechanical  or  fire  damage. 

2.  Both  the  ejection  seat  and  canopy  rail  are  good  locations  for  a 
semi-protected  fly-away  memory  pack  in  terms  of  survivability.  However, 
this  location  is  discouraged  for  two  reasons: 

a.  Violates  ground  rules  for  Configurations  I  and  III. 

b.  The  ejection  ratio  for  the  A-10  is  far  too  low  to  permit 
this  location  to  be  used  for  semi-  survivable  modules  while  still  satis¬ 
fying  90%  survivability. 

3.  The  wing  tips  are  a  good  location  for  the  CSMU. 

4.  The  vertical  tail  and  tail  cone  sections  are  reasonable  alterna¬ 
tives  to  the  wing  tips. 

5.  The  avionics  bay  is  acceptable  as  a  location  for  the  non-survivabie 
data  compression/data  processing  functions. 
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COMPOSITE  CONCLUSIONS 


For  the  preferred  installation  locations,  tail  sections  and  wing 
tips,  the  CSMU  must  survive  impact  velocities  up  to  550  fps  for  impact 
angles  up  to  70°  nose  down. 

SUMMARY  OF  ACCIDENT  DATA  FOR  221  A/F/T  CLASS-A  MISHAPS  FROM  1976  TO  DATE 


The  aircraft  type,  number  of  accidents,  dollar  value  range  of  the 
destroyed  aircraft,  dollar  value  average  of  the  destroyed  aircraft,  and 
ejection  ratio  are  shown  in  table  D-3.  A  composite  average  for  all 
A/F/T  aircraft  is  also  included.  (The  ejection  ratio  is  the  number  of 
times  the  crew  members  ejected  divided  by  the  number  of  times  the  aircraft 
impacted  the  surface  in  an  out-of-control  situation.) 

CONCLUSIONS  FROM  A/F/T  MISHAPS  (1976  TO  DATE) 

1.  Except  for  the  F-16  aircraft,  the  ejection  ratios  are  not  good 
enough  to  consider  the  ejection  seat  or  canopy  as  a  location  for  a 
semi-survivable  module  under  the  single  CSMU  concept.  These  locations 
do  have  value,  however,  for  the  multiple  memory  concept. 

The  ejection  ratio  for  all  A/F/T  Class-A  mishaps  ranges  from  41.1% 
to  100%,  with  the  composite  average  computed  to  be  about  66.9%.  The 
A-10/F-15/F-16  composite  is  computed  to  be  59.3%  at  this  time. 

2.  The  dollar  value  of  Class-A  mishaps  ranges  from  0.167M  to 

15. 4M,  with  the  composite  average  computed  to  be  4.8M.  The  A-10/F-15/ 

F-16  mishaps  range  from  2.6M  to  12. 7M,  and  average  out  to  be  9.3M  per 
Class-A  mishap. 

5.  The  test  sequence  used  to  simulate  a  crash  for  commercial 
recorders  is  also  valid  for  A/F/T  aircraft.  The  sequence  is: 

impact 
penetration 
static  crush 
fire 
water 

In  spite  of  the  fact  that  USAF  operates  over  land  more  than  the 
USN,  the  water  test  is  required  because  a  significant  number  of  USAF 
mishaps  resulted  in  water-submerged  aircraft.  The  humidity  test  is  not 
critical  and  could  be  made  a  part  of  the  environmental  qualification 
test  or  part  of  the  crash  survivability  test. 
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Table  D-3.  A/F/T  Class-A  Mishap  Summary 


USAF 

AIRCRAFT 

TYPE* 

NUMBER 

OF  CLASS-A 

MISHAPS 

REVIEWED 

— 

DOLLAR  VALUE 
RANGE  OF 
DESTRUCTION 
(M) 

AVERAGE 

DOLLAR  VALUE 

OF  DESTRUCTION 
(M) 

CREW 

EJECTION 

RATIO 

(%) 

A- 7 

24 

2.6  -  3.69 

3.1 

75.0 

A- 10 

15 

2.6  -  7.4 

5.5 

41.1 

F-4 

77 

1.6  -  12.1** 

3.0 

66.2 

F-5 

6 

.69  -  3.9 

2.9 

66.7 

F-15 

17 

11.3  -  11.9 

11.7 

69.2 

F-16 

5 

12.6  -  12.7 

12.63 

80.0 

QF- 102. 

1 

0.95 

0.95 

100.0 

F-105 

15 

1.3  -  6.1 

3.2 

86.7 

F-106 

10 

4.7  -  5.9 

5.1 

60.0 

F-lll 

22 

1.8  -  15.4 

11.8 

63.6 

T-37 

5 

.167  -  .284 

.191 

60.0 

T-38 

24 

.219  -  1.60 

1.02 

66.7 

COMPOSITE 

A/F/T 

221 

.167  -  15.4 

4.8 

66.9 

A-10/F-15/F-16 

COMPOSITE 

37 

2.6  -  12.7 

9.3 

59.3 

*  Additional  aircraft  types  reviewed  but  not  shown  on  this  table 
F- 101,  A-4,  A-37,  F- 104,  and  F-100. 

**  Contained  expensive  weapons. 


are:  KA-3, 
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APPENDIX  E 


Impact  Testing 

The  following  short  appendix  describes  the  preliminary  impact  shock 
testing  which  was  undertaken  to  verify  the  mechanical  design  worthiness 
of  our  CPM.  The  test  setup,  procedures,  and  results  are  briefly  described. 

PRELIMINARY  IMPACT  TESTING 

Some  preliminary  Impact  Testing  has  been  completed  in  LSI's  Environ¬ 
mental  Test  Lab.  A  quick  release  package  drop  tester  was  used  to  drop  a 
6"  cube,  21  Ibm.  aluminum  block  from  heights  varying  from  32”  to  9'. 

The  drop  weight  was  instrumented  with  an  Endevco  accelerometer  to  measure 
the  resulting  shock  pulse  and  its  duration.  The  aluminum  block  was 
fixtured  with  a  guide  rail  and  bracket,  so  that  the  block  would  impact 
in  a  flush  and  repeatable  manner. 

The  testing  was  designed  to  vary  the  drop  height  and  impact  media 
in  hopes  of  attaining  shock  pulses  in  excess  of  1000  G.  and  5  msec, 
duration.  In  addition,  a  simulated  memory  module  of  similar  construc¬ 
tion  to  the  CSFDR  system  Crash  Protected  Memory  (CPM)  was  mounted  to  the 
block,  in  order  to  verify  its  impact  shock  worthiness.  The  module  was 
shim  mounted  along  its  two  short  edges  to  simulate  a  worst  case  condition 
(see  sketch) . 

Approximately  70  drops  were  completed  and  the  simulated  CPM  sub¬ 
strate  survived  without  suffering  any  noticeable  damage.  The  impact 
media  included  Dupont  Aduprene,  G.E.  Elastomeric  pads,  hard  rubber  pads, 

V  plywood,  molded  lead  cone  shaped  billets,  and  various  combinations  of 
the  above.  The  shock  pulse  amplitude  and  duration  was  measured  with  an 
Endevco  shock  amplifier  and  digital  display.  In  addition,  the  shock 
pulse  shapes  were  captured  on  a  Tektronics  oscilloscope.  The  shock 
pulses  were  consistently  initial  peak  sawtooth  pulses  and  the  fixturing 
resulted  in  attaining  somewhat  repeatable  results. 

The  resulting  shock  pulses  ranged  in  magnitude  from  150  to  4580  G. 
peak  v ith  time  durations  ranging  from  .2  to  13.6  milliseconds.  The 
majority  of  shock  oulses  had  too  short  of  a  time  duration,  with  most 
falling  under  3  milliseconds  in  length.  Some  of  the  more  noteworthy 
impact  shock  pulses  are  listtd  below. 


2130 

G. 

5.3  msec. 

2190 

G. 

3.34  msec 

1900 

G. 

6.0  msec. 

1800 

G. 

1 . 5  msec . 

200 

G. 

11.4  msec. 

4580 

G. 

.32  msec 

This  testing  leaves  no  doubt  that  the  CPM  design  will  be  structurally 
shot k  worthy  of  the  CSFDR  system  impact  shock  requirements. 
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Figure  E-l.  Sketch  of  Impact  Test  Fixtu  e 


Appendix  F 


Cross  Reference  of  Military  Directives  Related  to 
Aircraft  Accident  Safety  Investigation 


Applicable  Directive 


Air  Force 

Navy,  USNR, 

Army 

ANG 

Marine  Corps 

ARNG 

Coast-Guard 

USAFR 

USMCR 

USAR 

Aircraft 

AFR  127-4 

OPNAV  INST 

AR  385-40 

Chapter 

Accidents 

AFM  87-18 

AFM  93-1 

AFR  160-109 
AFM  127-1 

AFR  127-2 

AFR  190-20 

2750.6 

AR  95-5 

2B  of  CG  40 

Missing  Aircraft 

AFR 

127-4 

OPNAV  INST 

AR 

385-40 

Chapter 

AFR 

23-19 

3750.6 

AR 

95-5 

2B  of  CG-405 

AFM 

55-8 

AFM 

30-25 

AFR 

127-2 

Investigat ing 

AFR 

11-1 

JAG 

AR 

385-40 

CG  Supplement 

Boards 

AFR 

35-67 

Manual 

AR 

15-6 

to  the  Manual 

AFR 

110-14 

OPNAV  INST 

AR 

95-5 

for  Courts- 

AFR 

127-4 

3750.6 

Martial  CG-24 

AFR 

62-5 

AFM 

127-2 

Accident  Claims 

AFM 

112-1 

JAG 

AR 

27-20 

COMDTINST 

AFR 

127-4 

Manual 

5890.4  series 

AFM 

127-1 

News  Releases 

AFR 

190-10 

NAVS0 

AR 

340-16 

CG-247 

AFR 

205-1 

P-1035 

AR 

360-5 

A’f'M 

30-25 

AR 

340-17 

AFR 

127-4 

AR 

360-80 

AFM 

127-1 

Flying 

AFR 

62-5 

OPNAV  INST 

AR 

95-12 

CG-333 

Violations 

AFR 

127-4 

3760.1 

AFM 

127-1 

AFR 

127-2 
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Air  Traffic  AFR  55-19  OPNAV  INST  AR  95-1  CG-333 

Cont-ol  &  Flight  AFR  86  series  3710.7  AR  95-9 

Rules  AFM  60-5  AR  95-37 

NGR  95 

TM  1/2557-26 

29 

30 


NTSB  Organizational/Proced’ ral  Regulations 


CODE  PART  NUMBER 

49  USC  1801 

800 

801 

821 

830 


831 

835 


TITLE 

Transportation  Safety  Act  of  1974 
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FOREWORD 


There  is  a  need  to  provide  engineers,  decisionmakers 
and  analysts  with  a  do-it-yourself,  quick  reaction 
capability  to  make  life  cycle  cost  assessments.  Currently 
assessing  the  life  cycle  cost  implications  of  design  and 
support  alternatives  is  both  time  consuming  and  costly. 

This  document  presents  a  life  cycle  cost  model  programmed 
for  a  TI  59  handheld  calculator.  By  using  this  analysis 
tool,  personnel  will  be  able  to  assess  the  life  cycle  cost 
implications  of  particular  alternatives  easily  and  quickly. 
This  model  can  be  used  by  anyone  equipped  with  a  TI -59 
handheld  progranmable' calculator. 


I  have  reviewed  and  approved  this  report. 


Director  of  Cost  analysis 
Comptroller 
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I.  INTRODUCTION 


The  introduction  of  handheld  programmable  calculators  has 
provided  a  tool  to  make  life  cycle  cost  assessments  of  design 
and  support  options  a  way  of  life.  The  key  advantage  of  this 
tool  is  that  it  drastically  shortens  the  feedback  loop  for 
information  on  life  cycle  cost  impacts.  Besides  providing  timely 
support,  another  important  advantage  of  this  tool  is  that  it 
allows  life  cycle  cost  assessments  to  be  generated  by  the  persons 
who  need  them  most.  Handheld  programmable  calculators  a^ng  with 
this  user's  guide  should  greatly  improve  communications  among 
the  different  disciplines  that  are  involved  in  designing, 
developing,  acquiring  and  supporting  lower  life  cycle  cost 
equipments. 

II.  DESCRIPTION  Of  THE  MODEL 


The  mcdel  is  as  complete  as  most  computer  life  cycle  cost  models. 
However,  significant  memory  capacity  is  saved  by  concentrating  on  a 
single  item  such  as  a  line  replaceable  unit.  This  avoids  the 
aggregation  and  control  coding  required  in  larger  system  models. 

Costs  are  printed  or  displayed,  at  the  user's  notion,  by  cost  element 
and  by  cost  category  (development,  acquisition,  operating  and  support 
and  total  life  cycle  cost). 

To  get  started,  a  data  set  of  33  variables  must  br  assembled.  Of 
these,  4  are  descriptive  of  the  program  environment,  19  are  descriptive 
of  the  item  or  equipment  and  8  are  standard  parameter  values  that  are 
most  appropriate  for  the  item  being  considered.  A  simple  data 
collection  worksheet  has  been  designed  for  this  purpose  (See  Appendix  3). 
This  worksheet  contains  the  variable  name,  dimensions,  a  column  for 
entering  the  value,  storage  location  and  variable  definition. 

After  the  data  is  collected,  no  more  than  five  minutes  are  required 
to  load  the  program,  enter  the  full  data  set,  and  run  the  program. 

Life  cycle  cost  can  be  calculated  with  the  "touch  of  a  button".  If  a 
printer  is  not  used,  a  flag  is  set  to  display  the  estimates.  The 
estimates  are  displayed  in  the  order  that  they  appear  on  the  Life  Cycle 
Cost  Analysis  Worksheet  (See  Appendix  2).  By  simply  pushing  the 
"R/5"  key,  the  next  estimate  in  this  sequence  will  appear  on  the 
calculator  display.  Appendix  6  provides  a  sample  output  If  the  printer 
is  used. 

To  change  the  data  set,  the  only  action  required  Is  to  enter  the 
new  data  in  the  same  storage  location  as  the  data  being  replaced.  By 
overriding  the  data  in  this  manner  the  latest  value  will  be  used  to 
complete  the  calculation.  This  feature  can  be  used  to  perform  sensitivity 
analyses  of  various  data  element,  in  a  timely  manner.  A  complete  set 
of  user's  instructions  is  included  in  Appendix  1. 
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In  addition  to  cost  data,  the  model  provides  other  data  that 
may  be  useful  to  an  analyst  or  decisionmaker.  For  example,  the 
model  computes  and  displays  the  quantity  of  spares  required  per 
base,  the  quantity  of  spares  required  at  the  depot  level  and  the 
quantity  of  condemnation  spares  that  are  expected  over  the  life 
of  the  program.  This  additional  information  provides  meaningful 
visibility  into  the  computation  results.  The  model  also  computes 
the  direct  manhours  per  base  per  year  and  the  direct  manhours 
required  at  the  depot  per  year.  This  information  is  useful  in 
assessing  the  impact  on  manpower  requirements.  Direct  manpower 
requirements  can  be  converted  to  manpower  equivalents  using 
AFM  26-3  procedures.  The  model  also  computes  the  peak  month 
direct  shop  manhours.  This  information  can  provide  some  insight 
into  the  base  shop  support  equipment  requirements.  The  depot 
direct  manhour  requirements  can  also  provide  some  insight  into 
the  depot  support  equipment  requirements.  The  model  does  not 
include  these  costs: 

(1)  training  equipment  and  services. 

(2)  documentation. 

(3)  facilities. 

(4)  War  Readiness  Materiel. 
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USER  INSTRUCTIONS 
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Q 
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43 

RCL 
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39 

39 
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57  57 
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40 

40 
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41 

41 
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91 

R/S 
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43 
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42 

42 
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91 
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43 

43 

455 

14  D 

398 

91 

R  S 
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43 
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44 

44 
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91 

R/S 
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54 
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APPENDIX  2 


LIFE  CYCLE  COST  ANALYSIS 
WORKSHEET 


LIFE  CYCLE  COST  ANALYSIS  WORKSHEET 


TOTAL  DEVELOPMENT 

COST 

■  c 

□  00 

PROCUREMENT 

SYSTEM  INVESTMENT 

= 

3  oi 

SUPPORT  INVESTMENT 

SUPPORT  EQUIPMENT 

■  c 

1 02 

BASE  SPARES 

-  c 

_ 134 

QTY  PER  BASE  =  f” 

□  35 

DEPOT  SPARES 

=  [ 

1  36 

QTY  =  i 

13  37 

02  + 

34  +36  =  (___ 

□  38 

TOTAL 

PROCUREMENT 

COST 

■  CZ 

- 

□  39 

OWNERSHIP 

BASE  MAINTENANCE  MANHOUR 

-  cz 

□  40 

DIRECT  MANHOURS  PER  BASE  PER 

•  c 

1  41 

YEAR 

PEAK  MONTH  DIRECT  SHOP 

-  c 

□  42 

MANHOURS 

BASE  MAINTENANCE  MATERIAL 

-  c 

□  43 

DEPOT  MAINTENACE  MANHOUR 

*  c 

□  44 

DIRECT  MANHOURS  °ER  YEAR 

=  [ 

145 

DEPOT  MAINTENANCE  MATERIAL 

■  C 

□  46 

SECOND  DESTINATION  TRANSPORTATION 

-  cz 

□  47 

CONDEMNATION  SPARES 

=  (Z 

3  48 

QTY  FOR  LIFE  CYCLE 

■  c 

Z49 

INVENTORY  MANAGEMENT 

-  E= 

□  50 

TOTAL  OWNERSHIP  COST  =  40+43+44+46+47+48+50 

•  CZ 

□  51 

LIFE  CYCLE  CCST  =00+39 

+  51 

-  c 

— 

ZJ  52 

NOTES: 
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APPENDIX  3 


DATA  COLLECTION  WORKSHEET 
(INPUT  PARAMETERS/VARIABLES) 


379 


DATA  COLLECTION  WORKSHEET 
.  INPUT  PARAMETER  VARIABLES 


VARIABLE 

NAME 


UNITS 


VALUE 


STORAGE 

LOCATION 


00 

01 

02 


PROGRAM  DATA 


03 

04 

05 

06 


ITEM  DATA 


DEFINITION 


Development  Cost 
System  Investment  Cost 
Support  Equipment  Cost 


Number  of  Operating  Bases 
Average  Annual  Operating  Hours 
Peak  Month  Operating  Hours 
Projected  Inventory  Usage  Period 


Lbs 

Hours 

Fraction 

Fraction 

Fraction 

Hours 
Hours 
Hours 
Hours 
Hours 
Hours 
5  • 

Months  ( .2  or  .33) 


Hours 

$ 


HjawmagitaigMig!  yinwiyi 


Unit  Cost  of  Item  as  a  Spare 
Weight  of  Item 
Mean  Time  Between  Failure 
Fraction  of  Failures  Not  Reparable  At  Base 
Fraction  of  Failures  Reparable  at  Base 
Fraction  of  Failures  where  Item  is 
Condemned 

Preparation  and  Access  Manhours 

Replacement  Manhours 

Scheduled  Maintenance  Interval 

Scheduled  Maintenance  Manhours 

Bench  Check  Manhours 

Base  Maintenance  Manhours 

Base  Direct  Material  Cost  per  Failure 

| 

I  Base  Repair  Cycle  Time  (Use  .2  for 
Avionics  or  .33  for  all  other  non- 
modular  equipment). 

Depot  Maintenance  Manhours 

Depot  Direct  Material  Cost  oer  Failure 

New  Reparable  Items  ("P"  coded) 

New  Consumable  Items  ("P"  coded) 

New  Consumable  Items  ("p"  coded)  stocked 
at  base  level 


DEFINITION 


Order  and  Shipping  Time 
Depot  Repair  Cycle  Time 
Base  Labor  Rate  per  Manhour 
Depot  Labor  Rate  per  Manhour 
Packing  4  Shipping  Cost  per  Lb. 

Base  Supply  Inventory  Management 
Cost  per  Item  per  Year 
Initial  Inventory  Management  Cost 
per  Item 

Recurring  Inventory  Management  Cost 
per  Item  per  Year 


♦These  are  1980  average  values  coverinq  all  commodities.  The  values  used  should 
be  the  most  appropriate  for  the  item  being  considered. 
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APPENDIX  4 


DATA  ELEMENT  DEFINITIONS 


-  PROGRAM  OR  ITEM  INPUT  VARIABLE 
«  STANDARD  VALUE 
»  COMPUTED  VALUE 


DATA  ELEMENT  DEFINITIONS 


AOH  -  Average  annual  operating  hours  expected  over  the  program 
inventory  usage  period.  (I) 

BCMH  -  Average  manhours  to  perform  a  shop  bench  check,  screening, 
and  fault  verification  of  an  item  prior  to  initiating 
repair  action  or  condemning  the  item.  (I) 

BLR  -  Base  Labor  Rate  including  direct  labor  and  indirect  labor 
and  material  costs.  (S) 

BMC  -  Average  direct  material  cost  to  repair  an  item  at  base 
level  including  direct  material  cost  of  repairing  lower 
level  assemblies.  (I) 

BMH  -  Average  manhours  to  perform  intermediate  level  (base  shop) 
maintenance  on  a  removed  item  including  fault  isolation, 
repair,  and  verification.  (I) 

BMHC  -  The  cost  of  base  maintenance  manhours  (direct  and  indirect) 
over  the  life  cycle.  (C) 

BMMC  -  Cost  of  material  to  repair  failed  units  at  the  base.  (C) 

BMMH  -  Direct  labor  manhours  per  year  to  accomplish  depot-level 

repairs.  ' (C) 

BRCT  -  Average  Base  Repair  Cycle  Time  in  months.  The  elapsed  time 
for  an  item  repaired  at  the  base  from  removal  of  the  failed 
item  until  it  is  returned  to  base  serviceable  stock  (less 
time  awaiting  parts).  For  items  of  a  "black  box"  variety 
(e.g.,  avionics  LRUs),  the  repair  of  which  normally  consists 
of  removal  and  replacement  of  "plug-in"  components  (SRUs). 
BRCT  =  0.20  months  (6  days).  For  other,  nonmodular  FLUs, 
BRCT  =  0.33  months  (10  days).  (I) 

BSC  -  The  cost  to  provide  base  repair  pipeline  spares  for  all 
bases.  (C) 

BSTK  -  The  number  of  spares  required  for  each  base  to  fill  the  base 
repair  pipeline  including  a  safety  stock  to  protect  against 
random  fluctuations  in  demand.  (C) 

COND  -  Fraction  of  failed  items  expected  to  result  in  condemnation. 

NOTE:  RTS  +  NRTS  +  COND  =  1  only  if  all  condemnations  occur 
at  base  level.  (I) 
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CSC  -  The  cost  of  spares  required  over  the  life  cycle  to  replace 
condemned  items.  (C) 

DEVC  -  All  nonrecurring  and  recurring  engineering,  tooling, 
manufacturing  (e.g.,  breadboards,  prototypes,  flight 
vehicles,  OT&E  Items,  IOT&E  items  and  spares  to  support 
RDT&E  efforts),  purchased  equipment,  quality  control, 
allowance  for  changes.  General  and  Administrative,  and 
Profit  associated  with  RDT&E  funded  efforts  over  the  life 
cycle  for  the  appropriate  Work  Breakdown  Structure  (WBS) 
elements.  (I) 

DLR  -  Qepot  Labor  Rate  including  direct  labor  and  indirect  labor 
and  material  costs.  (S) 

OMC  -  Average  direct  material  cost  to  repair  an  item  at  depot 
level  including  direct  material  cost  of  repairing  lower 
level  assemblies.  (I) 

DMH  -  Average  manhours  to  perform  depot-level  maintenance  on  a 
removed  item  including  fault  isolation,  repair,  and 
verification.  (I) 

DMHC  -  The  cost  to  accomplish  depot-level  maintenance  of  failed 
Items  over  the  program  inventory  usage  period.  (C) 

DMMC  -  The  cost  of  material  to  repair  failed  i  ^ns  at  the  depot 
level.  (C) 

DWH  -  The  direct  labor  manhours  per  year  to  accomplish  depot- 
level  repairs.  (C) 

DRCT  -  Average  depot  repair  cycle  time  In  months.  The  elapsed 

time  for  a  NRTS  item  from  removal  of  the  failed  item  until 
It  Is  made  available  to  depot  serviceable  stock.  (S) 

OSC  -  The  cost  to  provide  depot  repair  pipeline  spares.  (C) 

0STK  -  The  number  of  spares  required  to  fill  the  depot  repair 

pipeline.  (C) 

IMC  -  Initial  management  cost  to  Introduce  a  new  line  item  of 
supply  (assembly  or  piece  part)  Into  the  Government 
Inventory.  (S) 

IMMC  -  The  cost  to  enter  new  line  Items  of  supply  into  the 

Government  Inventory  and  to  manage  these  over  the  life  of 
the  equipment,  and  the  cost  of  base  level  supply  management 
of  these  new  items.  (C) 
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LCC  -  The  total  cost  to  the  Government  for  an  item  over  its  full 
life,  including  the  cost  of  development,  procurement  and 
ownership.  (C)  . 

M  -  Number  of  intermediate  repair  locations  (operating  bases). 

(I) 

MTBF  -  Mean  Time  Between  Failures  in  operating  hours  of  the  item  in 
the  operational  environment.  This  model  assumes  that  all 
failed  items  are  removed  for  repair.  (I) 

NRTS  -  Fraction  of  removed  items  expected  to  be  returned  to  the 
depot  for  repair.  (I) 

OST  -  Average  Order  and  Shipping  Time  in  months.  The  elapsed  time 
between  the  initiation  of  a  request  for  a  serviceable  item 
and  its  receipt  by  the  requesting  activity.  (S) 

PA  -  Number  of  new  "P"  coded  reparable  assemblies  within  the 
item.  (I) 

PAMH  -  Average  manhours  expended  on  the  installed  equipment  for 

preparation  and  assessment  to  the  item;  for  example,  jacking, 
unbuttoning,  removal  of  other  units  and  hook  up  of  support 
equipment.  (I) 

PCB  -  Number  of  new  "P"  coded  consumable  items  within  this  item 
that  will  be  stocked  at  base  level.  (I) 

P I UP  -  Program  Inventory  Usage  Period.  Operational  service  life 

in  years.  (I) 

PMSH  -  Direct  intermediate  level  (base  shop)  manhours  for  the  peak 
month.  (C) 

POH  -  Expected  operating  hours  for  one  month  during  the  peak 
usage  period.  (I) 

PP  -  Number  of  new  "P"  coded  consumable  items  within  this  item. 

(I) 

PSC  -  Average  Packing  and  Shipping  Cost.  (S) 

QCS  -  Quantity  of  spares  required  over  the  life  cycle  to  replace 
condemned  items.  (C) 

RMH  -  Average  manhours  to  fault  isolate,  remove,  and  replace  the 
item  on  the  installed  equipment  and  verify  restoration  of 
the  equipment  to  operational  status.  (I) 

RMC  -  Recurring  management  cost  to  maintain  a  line  item  of  supply 

(assembly  or  piece  part)  in  the  wholesale  inventory  system.  (S) 
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RTS  -  Fraction  of  failed  items  expected  to  be  repaired  at  base 
level.  (I) 

SA  -  Annual  base  supply  line  item  inventory  management  cost. 

(S) 

SOTC  -  The  cost  of  roundtrip  transportation  of  items  sent  to 
the  depot  for  repair.  (C) 

SEC  -  The  cost  of  equipment,  vehicles  and  tools  required  tc 
maintain  and  care  for  the  item  or  portions  of  the  item 
while  not  directly  engaged  in  the  performance  of  its 
mission  including  all  effort  associated  with  design 
development  and  production  of  the  support  equipment.  (I) 

SIC  -  The  cost  of  support  equipment,  base  spares  and  depot 
spares.  (C) 

SMH  -  Average  manhours  to  perform  a  scheduled,  periodic,  or 
phased  inspection  on  the  item.  (I) 

SMI  -  Operating  hour  intervals  between  scheduled,  periodic,  or 
phased  inspections  on  the  item.  (I) 

SYSI  -  The  cost  of. acquiring  the  production  funded  items  including 
engineering,  tooling,  manufacturing,  subcontract,  purchased 
parts  and  equipment,  quality  control,  General  and 
Administrative  (G&A)  and  Profit.  (I) 

t  -  Pipeline  time  In  months  computed  by  the  following 
equation:  (C) 

t  -  (RTS) ( BRCT)  +  (NRTS) (OST) 

TOC  -  The  total  cost  of  ownership  including,  base  maintenance 
manhour  and  material  costs,  depot  maintenance  manhour  and 
material  cost,  second  destination  transportation  costs, 
condemnation  spares  costs  and  inventory  management  costs. 

(C) 

TPC  -  The  total  cost  of  system  investment  and  support  investment. 
(C) 

UC  -  Expected  unit  cost  of  the  item  at  the  time  of  initial  spares 
provisioning.  (I) 

W  -  Item  unit  weight  in  pounds.  (I) 
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APPENDIX  5 


LCC  MODEL 
EQUATIONS 
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1.  BASE  SPARES  (BSTK) 


r  “i 

\f 

r—  i 

1  POH 

t  +  1 . 5  \  / 

POH 

(MJ(HTBF) 

V 

(M)  (MTS'7)  | 

where  t  =  Pipeline  time  in  months 
t  =  (RTS) (BRCT)  +  (NRTS)(0ST) 

This  equation  computes  the  number  of  spares  required  for  each  base  to 
fill  the  base  repair  pipeline  including  a  safety  stock  to  protect 
against  random  fluctuations  in  demand.  The  computation  considers  the 
mean  demand  rate  per  base  and  a  coefficient  which  represents  a  95  per¬ 
cent  probability  of  satisfying  a  demand  where  the  distribution  of 
probabilities  of  a  demand,  given  a  mean  demand,  is  Poisson. 

NOTE:  The  program  integerizes  the  fractional  spares  quantity  to  the 
next  higher  integer  value. 

2.  BASE  SPARES  COST  (BSC) 

BSC  =  (M) (BSTK) (UC; 

This  equation  computes  the  cost  to  provide  base  repair  pipeline  spares 
for  all  bases. 

3.  DEPOT  SPARES  (DSTK) 

DSTK  =  (PQH) (NRTS) (DRCT) 

MTBF 

This  equation  computes  the  number  of  spares  required  to  fill  the  depot 
repair  pipeline. 

NOTE:  The  program  integerizes  the  fractional  spares  quantity. 

4.  DEPOT  SPARES  COST  (DSC) 

DSC  »  (DSTK) (UC) 

This  equation  computes  the  cost  to  provide  depot  repair  pipeline  spares. 

5.  BASE  MAINTENANCE  MANHOURS  (BMMH) 

BMMH  =  (AOH) 


PAMH  +  RMH  +  BCMH  +  ( RTS ) ( BMH ) 


0 


The  first  term  computes  the  direct  base  maintenance  manhours  per  base 
per  year  including  preparation  and  access  time,  removal  and  replacement 
time,  bench  check  time  and  the  repair  time  for  those  items  repaired 
in  the  base  intermediate  shop. 

The  second  term  computes  the  labor  manhours  to  perform  scheduled 
maintenance  per  base  per  year.  This  information  can  provide  insight 
into  base  manpower  requi rements. 

6.  BASE  MAINTENANCE  MANHOUR  COST  (BMHC) 

8MHC3  (8MMH) (M) (PIUP) (BLR) 

This  equation  computes  the  cost  of  base  maintenance  manhours  over  the 
life  cycle. 

7.  PEAK  DIRECT  BASE  MAINTENANCE  SHOP  MANHOURS  (PMSH) 

r~  i 

PMSH  *  ( POH )  j(BCMH)  +  (RTS)(BMH), 

™TMy(WBfT~  L  J 

This  equation  computes  the  direct  intermediate  shop  manhours  for  the  peak 
month.  This  information  can  provide  insight  into  support  equipment 
utilization. 

8.  BASE  MAINTENANCE  MATERIAL  COST  (3MMC) 

BMMC  =  (AOH) (PIUP) (RTS) (BMC) 

(MtBFj 


This  equation  computes  the  cost  of  material  to  repair  failed  items  at  the 
base. 

9.  DEPOT  MAINTENANCE  MANHOURS  (OMMH) 

DMMH  =  (AOH) ( NRTS) (DMH) 

(MTBF) 


This  equation  computes  the  direct  labor  manhrars  per  year  to  accomplish 
depot-level  repairs.  This  information  can  provide  insight  into  depot 
manpower  and  depot  support  equipment  requirements. 

10.  DEPOT  MAINTENANCE  MANHOUR  COST  (DMHC) 

OMHC  -  (OMMH) (PIUP) (OLR) 

Tnis  equation  computes  the  cost  to  accomplish  depot-level  maintenance 
of  failed  items  over  the  life  cycle. 
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1 1 .  DEPOT  MAINTENANCE  MATERIAL  COST  (DMMC) 


DMMC  =  (AOH)(PIUP)jNftTS)(DMC) 


This  equation  computes  the  cost  of  material  to  repair  failed  items  at 
the  depot  level. 


12. 


SECOND  DESTINATION  TRANSPORTATION  COST  (SDTC) 


(PSC) (1 .35) (W) 


This  equation  computes  the  cost  of  roundtrip  transportation  of  items 
sent  to  the  depot  for  repair.  The  1.35  factor  is  the  ratio  of  packed 
to  unpacked  weight. 

13.  CONDEMNATION  SPARES  (QCS) 


QCS  =  (A0H)(PIUP)(C0ND) 
MTfF 


This  equation  computes  the  quantity  of  spares  required  over  the  life 
cycle  to  replace  condemned  items. 

NOTE:  The  program  integerizes  ihe  fractional  spares  quantity. 

14.  CONDEMNATION  SPARES  COST  (CSC) 

CSC  *  (QCS )  (UC) 

This  equation  computes  the  cost  of  spares  required  over  the  life  cycle 
to  replace  condemned  Items. 

15.  INVENTORY  MANAGEMENT  COST  (IMCC) 

IMCC  *  jnC  +  (PIUPMRMcjj  (PA  +  PP  +  1) 

♦  (M)(SA) (PIUP)  (PA  +  PCB  +  1) 

The  first  term  computes  the  cost  to  enter  new  line  items  of  supply  into 
the  Government  inventory  and  to  manage  them  over  the  life  of  the  equipment. 

The  second  term  computes  the  cost  of  base  level  supply  management  of  these 
i  terns . 
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APPENDIX  6 


SAMPLE  OUTPUT 


T9C 


i 


e 


]  0000. 

00 

100000. 

01 

1000. 

02 

10. 

03 

10000. 

04 

1000. 

05 

10. 

06 

100. 

07 

10. 

08 

500. 

09 

0.  8 

10 

0.  2 

11 

0.  1 

12 

0.  5 

13 

1. 

14 

250. 

15 

.  10. 

16 

0.  1 

17 

1. 

18 

20. 

19 

0.  2 

20 

10. 

21 

40. 

•~i  ’“i 

1. 

il  O 

10. 

24 

0. 

oc 

5 

2  b 

£• 

15. 

23 

25. 

29 

« 

i  . 

30 

50. 

31 

50. 

100. 

1000. 

34 

1. 

35 

400. 

36 

4. 

O  i 

2400. 

38 

1 02400. 

39 

65400. 

40 

43.  6 

41 

0.  06 

42 

800. 

43 

40000. 

44 

!  60. 

45 

6  4  U  0 . 

■i6 

4320. 

47 

2000. 

48 

20. 

49 

22600. 

50 

3  41520. 

51 

253920. 

52 

10  00. 

53 

160. 

5*r 

20. 

55 

0. 

56 

20. 

57 

i* 

, 


r 
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CSFDR  SYSTEM  LCC 
Input  Parameters 
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Table  H-l 


Input  Parameters  for  Configuration  I 


VARIABLE 

NAME 

STOR. 

LOC. 

DPU  LRU 

DPU  SRU(AVG. ) 

CSMU 

DEVC 

1  1 

2,382,800 

SYS  I 

mu 

84,010,900 

(All  DEVC.SYSI, 

SEC  costs  inputted  under 

SEC 

EH 

DPU  LRl) 

M 

03 

68 

68 

68 

AOH 

04 

945,000 

945,000 

945,000 

POH 

05 

94,500 

94,500 

94,500 

PIUP 

06 

20 

20 

20 

UC* 

07 

W 

08 

8.4 

0.5 

2.8 

MTBF 

09 

5,260 

48,648 

63,580 

NRTS 

10 

.05 

1.0 

1.0 

RTS 

11 

.95 

0 

0 

COND 

12 

0 

0 

0 

PAMH 

13 

0 

0 

0 

RMK 

14 

1.0 

0 

1.0 

SMI 

15 

0 

0 

0 

SMH 

16 

0 

0 

0 

BCMH 

17 

1.0 

0 

1.0 

BMH 

18 

2 

0 

0 

BMC 

19 

0 

0 

0 

BRCT 

20 

.2 

.2 

.2 

DMH 

21 

5 

11 

11 

nric 

22 

0 

150 

200 

PA 

23 

9 

9 

2 

PP 

24 

0 

18 

5 

PCB 

25 

0 

0 

0 

^Company  Proprietary 
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Table  H-2 


Input  Parameters  for  Configuration  II 


VARIABLE 

NAME 

STOR. 

LOC. 

DPU  LRU 

DPU  SRU(AVG. ) 

CSMU 

DEVC 

1 

2,159,600 

SYS  I 

72,349,400 

(All  DEVC , SYSI , 

SEC  costs  inputted  under 

SEC 

■la 

DPU  LRU) 

M 

68 

68 

68 

AOH 

■ 

945,000 

945,000 

945,000 

POH 

94,500 

94,500 

94,500 

PIUP 

06 

20 

20 

20 

UC* 

07 

W 

08 

7.6 

0.5 

2.4 

MTBF 

09 

5,580 

45,714 

89,000 

NRTS 

10 

.05 

1.0 

1.0 

RTS 

11 

.95 

0 

0 

COND 

12 

0 

0 

0 

PAMH 

i  3 

0 

0 

0 

RMH 

14 

1.0 

0 

0 

SMI 

15 

0 

0 

0 

SMH 

16 

0 

0 

0 

BCilH 

17 

1.0 

0 

0 

BMH 

18 

2.0 

0 

0 

BMC 

19 

0 

0 

0 

BRCT 

20 

.2 

.2 

.2 

DMH 

21 

5.0 

11.0 

11.0 

DMC 

22 

0 

150 

200 

PA 

23 

8 

8 

2 

PP 

24 

0 

18 

5 

PCB 

25 

_  _ 

0 

0 

0 

"Company  Proprietary 
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Table  H-3 


Input  Parameters  for  Configuration  III 


VARIABLE 

NAME 

STOR. 

LOC. 

DPU  LRU 

DPU  SRU(AVG. ) 

CSMU 

MSU 

DEVC 

00 

2,899,200 

SYS  I 

01>1 

(All  DEVC ,SYSI , SEC  costs  inputted 

98,572,6001 

SEC 

02  J 

under  MSU) 

M 

03 

68 

68 

68 

68 

AOH 

04 

945,000 

945,000 

945,000 

189, 0002 

POH 

05 

94,500 

94,500 

94,500 

18.9003 

PIUP 

06 

20 

20 

20 

20 

UC* 

07 

W 

08 

8.4 

0.5 

2.8 

5.0 

MTBF 

09 

5,260 

48,648 

63,580 

3,400 

NETS 

10 

.05 

1.0 

1.0 

1.0 

RTS 

11 

.95 

0 

0 

0 

COND 

12 

0 

0 

0 

0 

PAMH 

13 

0 

0 

0 

0 

RMH 

14 

1.0 

0 

1.0 

1.0 

SMI 

15 

0 

0 

0 

12.5 

SMH 

16 

0 

0 

o 

.25 

BCMH 

17 

1.0 

0 

1.0 

0 

BMH 

18 

2 

0 

0 

0 

BMC 

19 

0 

0 

0 

0 

BRCT 

20 

.2 

.2 

.2 

o 

DMH 

21 

5 

11 

11 

.2 

DMC 

o | 

0 

150 

200 

11 

PA 

23 

9 

9 

2 

200 

PP 

24 

0 

18 

5 

2 

PCB 

25 

0 

0 

0 

5 

0 

'•'Company 

Proprietary 

1  127,745,700  if 

all  aircraft 

Have  Conf iguration  III. 

2  945,000 

if  all 

aircraft  have 

Configuration  III. 

3  94,500 

if  all  aircraft  have  Configuration  III. 
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